Overview
overview
10Static
static
3Loader_dll...es.dll
windows10-2004-x64
1Loader_dll...ce.dll
windows10-2004-x64
7Loader_dll...er.dll
windows10-2004-x64
1Loader_dll...st.dll
windows10-2004-x64
1Loader_dll...cs.dll
windows10-2004-x64
1Loader_dll...47.dll
windows10-2004-x64
1Loader_dll...12.exe
windows7-x64
1Loader_dll...12.exe
windows10-2004-x64
10Analysis
-
max time kernel
93s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
Loader_dll/MsMpRes.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Loader_dll/TableTextService.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Loader_dll/WordpadFilter.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Loader_dll/addition/EppManifest.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Loader_dll/addition/MsMpLics.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Loader_dll/d3dcompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Loader_dll/loaderV12.exe
Resource
win7-20241010-en
General
-
Target
Loader_dll/loaderV12.exe
-
Size
62.3MB
-
MD5
8e533e9d973e49f1251a5a5343650130
-
SHA1
2c94ccaf726d034c426425e6b74755b941880566
-
SHA256
6465765c30c964f99f3afadb81383993893cfcbb47d4740b368a11e5dc614f1e
-
SHA512
a03ce278551642f8e615dbf617d6480794909f5648e108644f1db9c5a694a334c6b14ed3bc1b82da65e67e78d2d03f3871335d19116ad4624fdc1e0ca32a0d38
-
SSDEEP
393216:W5HH6Cms5ku95LoagbWWToiadeqW5ZKwq/2Q3HAswsOjNnFRujVebELXD6uP9wjT:WhH6CmsXV1WpaAPZc2ugV2ebVuP+/
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2224 created 2616 2224 driver1.exe 44 -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2448 powershell.exe 1524 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2224 driver1.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3540 2224 WerFault.exe 90 2524 2224 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language driver1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 14 Go-http-client/1.1 HTTP User-Agent header 19 Go-http-client/1.1 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e loaderV12.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e loaderV12.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 loaderV12.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2448 powershell.exe 2448 powershell.exe 1524 powershell.exe 1524 powershell.exe 2224 driver1.exe 2224 driver1.exe 2224 driver1.exe 2224 driver1.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe 4988 svchost.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 1524 powershell.exe Token: SeIncreaseQuotaPrivilege 1144 wmic.exe Token: SeSecurityPrivilege 1144 wmic.exe Token: SeTakeOwnershipPrivilege 1144 wmic.exe Token: SeLoadDriverPrivilege 1144 wmic.exe Token: SeSystemProfilePrivilege 1144 wmic.exe Token: SeSystemtimePrivilege 1144 wmic.exe Token: SeProfSingleProcessPrivilege 1144 wmic.exe Token: SeIncBasePriorityPrivilege 1144 wmic.exe Token: SeCreatePagefilePrivilege 1144 wmic.exe Token: SeBackupPrivilege 1144 wmic.exe Token: SeRestorePrivilege 1144 wmic.exe Token: SeShutdownPrivilege 1144 wmic.exe Token: SeDebugPrivilege 1144 wmic.exe Token: SeSystemEnvironmentPrivilege 1144 wmic.exe Token: SeRemoteShutdownPrivilege 1144 wmic.exe Token: SeUndockPrivilege 1144 wmic.exe Token: SeManageVolumePrivilege 1144 wmic.exe Token: 33 1144 wmic.exe Token: 34 1144 wmic.exe Token: 35 1144 wmic.exe Token: 36 1144 wmic.exe Token: SeIncreaseQuotaPrivilege 1144 wmic.exe Token: SeSecurityPrivilege 1144 wmic.exe Token: SeTakeOwnershipPrivilege 1144 wmic.exe Token: SeLoadDriverPrivilege 1144 wmic.exe Token: SeSystemProfilePrivilege 1144 wmic.exe Token: SeSystemtimePrivilege 1144 wmic.exe Token: SeProfSingleProcessPrivilege 1144 wmic.exe Token: SeIncBasePriorityPrivilege 1144 wmic.exe Token: SeCreatePagefilePrivilege 1144 wmic.exe Token: SeBackupPrivilege 1144 wmic.exe Token: SeRestorePrivilege 1144 wmic.exe Token: SeShutdownPrivilege 1144 wmic.exe Token: SeDebugPrivilege 1144 wmic.exe Token: SeSystemEnvironmentPrivilege 1144 wmic.exe Token: SeRemoteShutdownPrivilege 1144 wmic.exe Token: SeUndockPrivilege 1144 wmic.exe Token: SeManageVolumePrivilege 1144 wmic.exe Token: 33 1144 wmic.exe Token: 34 1144 wmic.exe Token: 35 1144 wmic.exe Token: 36 1144 wmic.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2448 1584 loaderV12.exe 83 PID 1584 wrote to memory of 2448 1584 loaderV12.exe 83 PID 2448 wrote to memory of 1524 2448 powershell.exe 85 PID 2448 wrote to memory of 1524 2448 powershell.exe 85 PID 1584 wrote to memory of 1144 1584 loaderV12.exe 86 PID 1584 wrote to memory of 1144 1584 loaderV12.exe 86 PID 1584 wrote to memory of 2224 1584 loaderV12.exe 90 PID 1584 wrote to memory of 2224 1584 loaderV12.exe 90 PID 1584 wrote to memory of 2224 1584 loaderV12.exe 90 PID 2224 wrote to memory of 4988 2224 driver1.exe 93 PID 2224 wrote to memory of 4988 2224 driver1.exe 93 PID 2224 wrote to memory of 4988 2224 driver1.exe 93 PID 2224 wrote to memory of 4988 2224 driver1.exe 93 PID 2224 wrote to memory of 4988 2224 driver1.exe 93 PID 1584 wrote to memory of 720 1584 loaderV12.exe 106 PID 1584 wrote to memory of 720 1584 loaderV12.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2616
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\Loader_dll\loaderV12.exe"C:\Users\Admin\AppData\Local\Temp\Loader_dll\loaderV12.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Loader_dll\loaderV12.exe\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Loader_dll\loaderV12.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\ProgramData\driver1.exeC:\ProgramData\driver1.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 3883⤵
- Program crash
PID:3540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 3963⤵
- Program crash
PID:2524
-
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.exe /sc onstart /ru SYSTEM2⤵
- Scheduled Task/Job: Scheduled Task
PID:720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 22241⤵PID:852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2224 -ip 22241⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59cff7f2ffa235062a389eafa44385df5
SHA197f06a91915400aaf0f2e93352172395e9dc1c66
SHA2561103d24428005f23b7c88bdaafc615d1b4ed4320f3554e096712c80dfc4048f8
SHA512aa242d26d02ed4eefe317781ad0692a2e70269221b26042a6f9e47ae18e286dda5dac3959397f85ea4a40ba82206a553c4b5e82962393142e45ab235fffbeadc
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82