Overview
overview
10Static
static
3Adobe Prem...uK.exe
windows7-x64
10Adobe Prem...uK.exe
windows10-2004-x64
10dllhelper.dll
windows7-x64
3dllhelper.dll
windows10-2004-x64
3dllhelper64.dll
windows7-x64
1dllhelper64.dll
windows10-2004-x64
1AdobeIPCBroker.exe
windows7-x64
3AdobeIPCBroker.exe
windows10-2004-x64
3customhook...ok.exe
windows7-x64
3customhook...ok.exe
windows10-2004-x64
3AdobePIM.dll
windows7-x64
4AdobePIM.dll
windows10-2004-x64
4Core.dll
windows7-x64
3Core.dll
windows10-2004-x64
3resources/...IM.dll
windows7-x64
4resources/...IM.dll
windows10-2004-x64
4Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
Adobe Premiere Pro 2022 22.0.0.169 RePack by KpoJIuK.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Adobe Premiere Pro 2022 22.0.0.169 RePack by KpoJIuK.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
dllhelper.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
dllhelper.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
dllhelper64.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
dllhelper64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
AdobeIPCBroker.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
AdobeIPCBroker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
customhook/AdobeIPCBrokerCustomHook.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
customhook/AdobeIPCBrokerCustomHook.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
AdobePIM.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
AdobePIM.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
resources/AdobePIM.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
resources/AdobePIM.dll
Resource
win10v2004-20241007-en
General
-
Target
AdobePIM.dll
-
Size
2.1MB
-
MD5
beb8e03bb664c6715efb2523d48a10a8
-
SHA1
a366eef76eb31fca69c0e4ad9f4ca1c8747dbf87
-
SHA256
e9df32510cecde28b237510f8e04c6861b2b27bc38886450e26e9f57044ccacf
-
SHA512
36b291fc2b808cec4668fb091f80afcdcadc7dec464b3da4364ac6213657378626fd12cd9e578206c9d3293aeb07e9b9807c9ef5576da1f1a1b2dfb4990b695d
-
SSDEEP
49152:g15hDTdnSb8oibZAPxoVxBFxo8GMcsNWsniXNTOfZ1D8LnU24M:g15hndnSOOyxBjo8GMcsNWtS1inUK
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db-journal rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2180 wrote to memory of 320 2180 rundll32.exe 82 PID 2180 wrote to memory of 320 2180 rundll32.exe 82 PID 2180 wrote to memory of 320 2180 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AdobePIM.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:320
-