Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 06:47

General

  • Target

    beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll

  • Size

    80KB

  • MD5

    bf46bab1022c64584244ca269610594e

  • SHA1

    b1d77fc357822d5b48c1298a4abe069ac5faa3f6

  • SHA256

    beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4

  • SHA512

    ac991930446ee369f91f886508ed950ca941d6a1eb4a256a7dfa79ca90000aae8453c4c3e8baa83ae9d2f550ce360b79c03cb054c7745f537302cf299a1da9ae

  • SSDEEP

    1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEUHk9aJn:5dbwovEVyqgoZmZXWfIdQdRaefPz

Score
6/10

Malware Config

Signatures

  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\beb9c4d83530e4179b6605b30a6170f43bae57ea46c40ceb30168c0a1cf379a4.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Windows\SysWOW64\arp.exe
        arp -a
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:2828
      • C:\Windows\SysWOW64\arp.exe
        arp -s 10.127.0.1 83-5f-35-5e-e5-0f
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:3668
      • C:\Windows\SysWOW64\arp.exe
        arp -s 10.127.255.255 55-36-99-8e-70-1c
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:264
      • C:\Windows\SysWOW64\arp.exe
        arp -s 136.243.76.173 e7-0a-94-76-fc-84
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:884
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.22 6a-bb-a8-8a-4d-82
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:3968
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.251 52-ac-31-66-99-16
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:5032
      • C:\Windows\SysWOW64\arp.exe
        arp -s 224.0.0.252 dd-18-1d-b9-19-0a
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:4060
      • C:\Windows\SysWOW64\arp.exe
        arp -s 239.255.255.250 05-eb-d0-d1-ab-db
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:4920
      • C:\Windows\SysWOW64\arp.exe
        arp -s 255.255.255.255 3d-58-c4-3b-70-65
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:244
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 712
        3⤵
        • Program crash
        PID:3476
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3824 -ip 3824
    1⤵
      PID:3600

    Network

    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      dl.delivery.mp.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      dl.delivery.mp.microsoft.com
      IN A
      Response
      dl.delivery.mp.microsoft.com
      IN CNAME
      dl.delivery.mp.microsoft.com.delivery.microsoft.com
      dl.delivery.mp.microsoft.com.delivery.microsoft.com
      IN CNAME
      dcat-f-nlu-net.trafficmanager.net
      dcat-f-nlu-net.trafficmanager.net
      IN CNAME
      fg.microsoft.map.fastly.net
      fg.microsoft.map.fastly.net
      IN A
      199.232.210.172
      fg.microsoft.map.fastly.net
      IN A
      199.232.214.172
    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      147 B
      390 B
      2
      2

      DNS Request

      104.219.191.52.in-addr.arpa

      DNS Request

      dl.delivery.mp.microsoft.com

      DNS Response

      199.232.210.172
      199.232.214.172

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3824-0-0x0000000010000000-0x0000000010033000-memory.dmp

      Filesize

      204KB

    • memory/3824-2-0x0000000010000000-0x0000000010033000-memory.dmp

      Filesize

      204KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.