Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 19:14 UTC
Static task
static1
Behavioral task
behavioral1
Sample
04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17.dll
Resource
win10v2004-20241007-en
General
-
Target
04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17.dll
-
Size
137KB
-
MD5
2338763483313f4469d83c96a61a2800
-
SHA1
e4443981eae80a46d2e487917e75d48d98ac3d25
-
SHA256
04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17
-
SHA512
a6e482391aee86c588a84a335eac1bfeb53db6ff7548d09e0aa476ab45e874e76e6d862bb3d50ebe87237e19370f38530da6f4aed8c94cb1adc83c710bfc78d6
-
SSDEEP
3072:xR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuQ:c25GgFny61mrau
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2104 332 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 2296 wrote to memory of 332 2296 rundll32.exe 31 PID 332 wrote to memory of 2104 332 rundll32.exe 32 PID 332 wrote to memory of 2104 332 rundll32.exe 32 PID 332 wrote to memory of 2104 332 rundll32.exe 32 PID 332 wrote to memory of 2104 332 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 2283⤵
- Program crash
PID:2104
-
-