b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35

General

Target

c6aabb27450f1a9939a417e86bf53217.dll
Size

1.2MB
MD5

c6aabb27450f1a9939a417e86bf53217
SHA1

b8ef3bb7575139fd6997379415d7119e452b5fc4
SHA256

b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35
SHA512

e5fe205cb0f419e0a320488d6fa4a70e5ed58f25b570b41412ebd4f32bbe504ff75acb20bfea22513102630cf653a41e5090051f20af2ed3aadb53ce16a05944
SSDEEP

24576:BO//kL3TtMhQsnoXyajMK8fCZEqcAxQBuLv8YPKpTG:z3pMhQzRM3MfcAxHv8t

Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3124	rundll32.exe
7	3124	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3940	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4316	netsh.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3124	rundll32.exe
3940	powershell.exe
3940	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4316	3124	rundll32.exe	82
PID 3124 wrote to memory of 4316	3124	rundll32.exe	82
PID 3124 wrote to memory of 3940	3124	rundll32.exe	84
PID 3124 wrote to memory of 3940	3124	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6aabb27450f1a9939a417e86bf53217.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\089630652159_Desktop.zip' -CompressionLevel Optimal
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\089630652159_Desktop.zip

Filesize
17KB

MD5
82577b7e6365c3c93489852e16da52cb

SHA1
a45537e224430ea75a50e33c6b351370d492745d

SHA256
2ac624b121bd8b0729628c231ed0537282ce0b7c364c178654261f48c67c4cbd

SHA512
34649e26ea9471135b481e1f178f92a9c9179c0b5f7970c5460c184d160970e03042b1dc6913d1432329184501ac4cc7463c58536688641e101c5c8a29724f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Files_\JoinSelect.docx

Filesize
20KB

MD5
94b5868118774cc6a643b6fb04d59350

SHA1
614f1a2039973c980871662703fa4ec89b6f1c90

SHA256
69c107b08769850efefb06e81f36368b9049652da6efab53b219c2daed3236e6

SHA512
21cde136310f1b0b3ac8255282c6c51a6082a562dc0f2ce47706c593751879420ae6f668d39708cb175bd5ae6a6c5ba313c7a1bcb0625b0d97b9d64146196e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s1rfcugl.4r2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3940-1-0x00007FFC7E383000-0x00007FFC7E385000-memory.dmp

Filesize
8KB

Download
memory/3940-4-0x0000019374FB0000-0x0000019374FD2000-memory.dmp

Filesize
136KB

Download
memory/3940-12-0x00007FFC7E380000-0x00007FFC7EE41000-memory.dmp

Filesize
10.8MB

Download
memory/3940-13-0x00007FFC7E380000-0x00007FFC7EE41000-memory.dmp

Filesize
10.8MB

Download
memory/3940-14-0x0000019374F80000-0x0000019374F92000-memory.dmp

Filesize
72KB

Download
memory/3940-15-0x0000019374BB0000-0x0000019374BBA000-memory.dmp

Filesize
40KB

Download
memory/3940-20-0x00007FFC7E380000-0x00007FFC7EE41000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads