Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-01-2025 12:58
Static task
static1
Behavioral task
behavioral1
Sample
0x000c000000023b81-1.dll
Resource
win7-20240708-en
General
-
Target
0x000c000000023b81-1.dll
-
Size
401KB
-
MD5
1d724f95c61f1055f0d02c2154bbccd3
-
SHA1
79116fe99f2b421c52ef64097f0f39b815b20907
-
SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
-
SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
-
SSDEEP
12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule behavioral1/files/0x0030000000016ce8-21.dat mimikatz -
Deletes itself 1 IoCs
pid Process 2668 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 2728 F383.tmp -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\F383.tmp rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2676 schtasks.exe 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2668 rundll32.exe 2668 rundll32.exe 2728 F383.tmp 2728 F383.tmp 2728 F383.tmp 2728 F383.tmp 2728 F383.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2668 rundll32.exe Token: SeDebugPrivilege 2668 rundll32.exe Token: SeTcbPrivilege 2668 rundll32.exe Token: SeDebugPrivilege 2728 F383.tmp -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2248 wrote to memory of 2668 2248 rundll32.exe 31 PID 2668 wrote to memory of 2824 2668 rundll32.exe 32 PID 2668 wrote to memory of 2824 2668 rundll32.exe 32 PID 2668 wrote to memory of 2824 2668 rundll32.exe 32 PID 2668 wrote to memory of 2824 2668 rundll32.exe 32 PID 2824 wrote to memory of 2684 2824 cmd.exe 34 PID 2824 wrote to memory of 2684 2824 cmd.exe 34 PID 2824 wrote to memory of 2684 2824 cmd.exe 34 PID 2824 wrote to memory of 2684 2824 cmd.exe 34 PID 2668 wrote to memory of 2128 2668 rundll32.exe 35 PID 2668 wrote to memory of 2128 2668 rundll32.exe 35 PID 2668 wrote to memory of 2128 2668 rundll32.exe 35 PID 2668 wrote to memory of 2128 2668 rundll32.exe 35 PID 2128 wrote to memory of 2676 2128 cmd.exe 37 PID 2128 wrote to memory of 2676 2128 cmd.exe 37 PID 2128 wrote to memory of 2676 2128 cmd.exe 37 PID 2128 wrote to memory of 2676 2128 cmd.exe 37 PID 2668 wrote to memory of 2592 2668 rundll32.exe 38 PID 2668 wrote to memory of 2592 2668 rundll32.exe 38 PID 2668 wrote to memory of 2592 2668 rundll32.exe 38 PID 2668 wrote to memory of 2592 2668 rundll32.exe 38 PID 2668 wrote to memory of 2728 2668 rundll32.exe 40 PID 2668 wrote to memory of 2728 2668 rundll32.exe 40 PID 2668 wrote to memory of 2728 2668 rundll32.exe 40 PID 2668 wrote to memory of 2728 2668 rundll32.exe 40 PID 2592 wrote to memory of 2588 2592 cmd.exe 42 PID 2592 wrote to memory of 2588 2592 cmd.exe 42 PID 2592 wrote to memory of 2588 2592 cmd.exe 42 PID 2592 wrote to memory of 2588 2592 cmd.exe 42
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0x000c000000023b81-1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0x000c000000023b81-1.dll,#12⤵
- Deletes itself
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1814289555 && exit"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1814289555 && exit"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:46:003⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 13:46:004⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2588
-
-
-
C:\Windows\F383.tmp"C:\Windows\F383.tmp" \\.\pipe\{99C6A4B7-310D-4901-9D2B-96977FE238D4}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787