Analysis
-
max time kernel
38s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 16:46
Static task
static1
1 signatures
General
-
Target
d3abf557101fe8ce97ea068290f87d24743cbe0bcbc73857e0e3f72edc225c0bN.dll
-
Size
730KB
-
MD5
219987362975616dc07d31e5fe0ff420
-
SHA1
01f77bfc5efebde4e305f47aba4411da661ca7bf
-
SHA256
d3abf557101fe8ce97ea068290f87d24743cbe0bcbc73857e0e3f72edc225c0b
-
SHA512
91f215e0629176d1d45c44503c68f535d0e9e409c01193bc74b8c1238a9e9e3a8eb6b021bd542d2275321855e16baaa975c3385c86a563a8bdaf6199f20e9a6f
-
SSDEEP
6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYi:o6RI1Fo/wT3cJYYYYYYYYYYYYi
Malware Config
Signatures
-
Yunsip family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4412 taskmgr.exe Token: SeSystemProfilePrivilege 4412 taskmgr.exe Token: SeCreateGlobalPrivilege 4412 taskmgr.exe Token: 33 4412 taskmgr.exe Token: SeIncBasePriorityPrivilege 4412 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe 4412 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4252 wrote to memory of 1652 4252 rundll32.exe 83 PID 4252 wrote to memory of 1652 4252 rundll32.exe 83 PID 4252 wrote to memory of 1652 4252 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3abf557101fe8ce97ea068290f87d24743cbe0bcbc73857e0e3f72edc225c0bN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3abf557101fe8ce97ea068290f87d24743cbe0bcbc73857e0e3f72edc225c0bN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1652
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4412