85c4f8e1d6f46ad59bdf53a6e74eff1140ac0ca8bfa269d9078f956c51b81766

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c4f8e1d6f46ad59bdf53a6e74eff1140ac0ca8bfa269d9078f956c51b81766.dll
Size

80KB
MD5

b3a7d85b86383396a23f306917fd6f5f
SHA1

fea0a693cfe01bb7b42d363c91a66f9962f0b598
SHA256

85c4f8e1d6f46ad59bdf53a6e74eff1140ac0ca8bfa269d9078f956c51b81766
SHA512

10f484eb96d75baeac0415bb4da208f820bc22b7681d24e71e6fa4b47fd50cd687877c2a2a6c23eb8d9a2324791652c4b0b344f8cb46b0190e5ef9bd8b0a391d
SSDEEP

1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEcGL0FLqUI7Hb:5dbwovEVyqgoZmZXWfIdQdRaefPDEZHb

Score

6^/10

discovery upx

Malware Config

Signatures

Network Service Discovery 1 TTPs 9 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1264	arp.exe
2632	arp.exe
4508	arp.exe
5016	arp.exe
2040	arp.exe
1560	arp.exe
1732	arp.exe
1968	arp.exe
3860	arp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1244-0-0x0000000010000000-0x0000000010033000-memory.dmp	upx
behavioral2/memory/1244-1-0x0000000010000000-0x0000000010033000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	1244	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	rundll32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1244	5012	rundll32.exe	83
PID 5012 wrote to memory of 1244	5012	rundll32.exe	83
PID 5012 wrote to memory of 1244	5012	rundll32.exe	83
PID 1244 wrote to memory of 2632	1244	rundll32.exe	85
PID 1244 wrote to memory of 2632	1244	rundll32.exe	85
PID 1244 wrote to memory of 2632	1244	rundll32.exe	85
PID 1244 wrote to memory of 1264	1244	rundll32.exe	88
PID 1244 wrote to memory of 1264	1244	rundll32.exe	88
PID 1244 wrote to memory of 1264	1244	rundll32.exe	88
PID 1244 wrote to memory of 3860	1244	rundll32.exe	89
PID 1244 wrote to memory of 3860	1244	rundll32.exe	89
PID 1244 wrote to memory of 3860	1244	rundll32.exe	89
PID 1244 wrote to memory of 1968	1244	rundll32.exe	90
PID 1244 wrote to memory of 1968	1244	rundll32.exe	90
PID 1244 wrote to memory of 1968	1244	rundll32.exe	90
PID 1244 wrote to memory of 1560	1244	rundll32.exe	91
PID 1244 wrote to memory of 1560	1244	rundll32.exe	91
PID 1244 wrote to memory of 1560	1244	rundll32.exe	91
PID 1244 wrote to memory of 2040	1244	rundll32.exe	92
PID 1244 wrote to memory of 2040	1244	rundll32.exe	92
PID 1244 wrote to memory of 2040	1244	rundll32.exe	92
PID 1244 wrote to memory of 5016	1244	rundll32.exe	93
PID 1244 wrote to memory of 5016	1244	rundll32.exe	93
PID 1244 wrote to memory of 5016	1244	rundll32.exe	93
PID 1244 wrote to memory of 1732	1244	rundll32.exe	94
PID 1244 wrote to memory of 1732	1244	rundll32.exe	94
PID 1244 wrote to memory of 1732	1244	rundll32.exe	94
PID 1244 wrote to memory of 4508	1244	rundll32.exe	95
PID 1244 wrote to memory of 4508	1244	rundll32.exe	95
PID 1244 wrote to memory of 4508	1244	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c4f8e1d6f46ad59bdf53a6e74eff1140ac0ca8bfa269d9078f956c51b81766.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c4f8e1d6f46ad59bdf53a6e74eff1140ac0ca8bfa269d9078f956c51b81766.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Windows\SysWOW64\arp.exe
    arp -s 10.127.0.1 e5-8f-b3-34-e3-e2
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1264
- - C:\Windows\SysWOW64\arp.exe
    arp -s 10.127.255.255 b5-ab-13-18-20-55
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:3860
- - C:\Windows\SysWOW64\arp.exe
    arp -s 37.27.61.181 ef-2c-26-41-c7-d0
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.22 5a-aa-fb-77-88-54
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1560
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.251 ff-2f-c5-25-fa-c6
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Windows\SysWOW64\arp.exe
    arp -s 224.0.0.252 bf-d8-ca-36-23-97
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\arp.exe
    arp -s 239.255.255.250 8b-ec-db-16-a4-88
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Windows\SysWOW64\arp.exe
    arp -s 255.255.255.255 51-b7-8f-76-f8-6d
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 712
    3⤵
    - Program crash
    PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1244 -ip 1244
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1244-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download