Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 06:47
Behavioral task
behavioral1
Sample
beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll
-
Size
80KB
-
MD5
bf46bab1022c64584244ca269610594e
-
SHA1
b1d77fc357822d5b48c1298a4abe069ac5faa3f6
-
SHA256
beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4
-
SHA512
ac991930446ee369f91f886508ed950ca941d6a1eb4a256a7dfa79ca90000aae8453c4c3e8baa83ae9d2f550ce360b79c03cb054c7745f537302cf299a1da9ae
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEUHk9aJn:5dbwovEVyqgoZmZXWfIdQdRaefPz
Malware Config
Signatures
-
pid Process 884 arp.exe 264 arp.exe 5032 arp.exe 3968 arp.exe 4920 arp.exe 4060 arp.exe 3668 arp.exe 2828 arp.exe 244 arp.exe -
resource yara_rule behavioral2/memory/3824-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/3824-2-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3476 3824 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3824 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3824 4952 rundll32.exe 83 PID 4952 wrote to memory of 3824 4952 rundll32.exe 83 PID 4952 wrote to memory of 3824 4952 rundll32.exe 83 PID 3824 wrote to memory of 2828 3824 rundll32.exe 84 PID 3824 wrote to memory of 2828 3824 rundll32.exe 84 PID 3824 wrote to memory of 2828 3824 rundll32.exe 84 PID 3824 wrote to memory of 3668 3824 rundll32.exe 88 PID 3824 wrote to memory of 3668 3824 rundll32.exe 88 PID 3824 wrote to memory of 3668 3824 rundll32.exe 88 PID 3824 wrote to memory of 264 3824 rundll32.exe 89 PID 3824 wrote to memory of 264 3824 rundll32.exe 89 PID 3824 wrote to memory of 264 3824 rundll32.exe 89 PID 3824 wrote to memory of 884 3824 rundll32.exe 90 PID 3824 wrote to memory of 884 3824 rundll32.exe 90 PID 3824 wrote to memory of 884 3824 rundll32.exe 90 PID 3824 wrote to memory of 3968 3824 rundll32.exe 91 PID 3824 wrote to memory of 3968 3824 rundll32.exe 91 PID 3824 wrote to memory of 3968 3824 rundll32.exe 91 PID 3824 wrote to memory of 5032 3824 rundll32.exe 92 PID 3824 wrote to memory of 5032 3824 rundll32.exe 92 PID 3824 wrote to memory of 5032 3824 rundll32.exe 92 PID 3824 wrote to memory of 4060 3824 rundll32.exe 93 PID 3824 wrote to memory of 4060 3824 rundll32.exe 93 PID 3824 wrote to memory of 4060 3824 rundll32.exe 93 PID 3824 wrote to memory of 4920 3824 rundll32.exe 94 PID 3824 wrote to memory of 4920 3824 rundll32.exe 94 PID 3824 wrote to memory of 4920 3824 rundll32.exe 94 PID 3824 wrote to memory of 244 3824 rundll32.exe 95 PID 3824 wrote to memory of 244 3824 rundll32.exe 95 PID 3824 wrote to memory of 244 3824 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 83-5f-35-5e-e5-0f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3668
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 55-36-99-8e-70-1c3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:264
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.76.173 e7-0a-94-76-fc-843⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:884
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 6a-bb-a8-8a-4d-823⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3968
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 52-ac-31-66-99-163⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:5032
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 dd-18-1d-b9-19-0a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4060
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 05-eb-d0-d1-ab-db3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4920
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 3d-58-c4-3b-70-653⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 7123⤵
- Program crash
PID:3476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3824 -ip 38241⤵PID:3600
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdl.delivery.mp.microsoft.comIN AResponsedl.delivery.mp.microsoft.comIN CNAMEdl.delivery.mp.microsoft.com.delivery.microsoft.comdl.delivery.mp.microsoft.com.delivery.microsoft.comIN CNAMEdcat-f-nlu-net.trafficmanager.netdcat-f-nlu-net.trafficmanager.netIN CNAMEfg.microsoft.map.fastly.netfg.microsoft.map.fastly.netIN A199.232.210.172fg.microsoft.map.fastly.netIN A199.232.214.172
-
Remote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
No results found
-
147 B 390 B 2 2
DNS Request
104.219.191.52.in-addr.arpa
DNS Request
dl.delivery.mp.microsoft.com
DNS Response
199.232.210.172199.232.214.172
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
4.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa