e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe
Size

408KB
MD5

de2fc5afa3845d736c1fedf7c42a39d6
SHA1

ff59253080cd98edb45c758c9756cb7f999fa9b6
SHA256

e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171
SHA512

d29e0acd5ba6947bad04b6d536b1d91443bce9136642f23ce1ddc9f938f781235e6acb513a6eb887b08ec44cea0aab7fbddbbedb47a43185d51bc242c4b63e05
SSDEEP

6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH48:gtRfJcNYFNm8UhlZGse8

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow pid process

20 1252 rundll32.exe
35 1252 rundll32.exe
36 1252 rundll32.exe
37 1252 rundll32.exe
53 1252 rundll32.exe
54 1252 rundll32.exe
66 1252 rundll32.exe
80 1252 rundll32.exe
Deletes itself 1 IoCs

Processes:

idrcdlnql.exe

pid process

892 idrcdlnql.exe
Executes dropped EXE 1 IoCs

Processes:

idrcdlnql.exe

pid process

892 idrcdlnql.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1252 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

flow	pid	process
20	1252	rundll32.exe
35	1252	rundll32.exe
36	1252	rundll32.exe
37	1252	rundll32.exe
53	1252	rundll32.exe
54	1252	rundll32.exe
66	1252	rundll32.exe
80	1252	rundll32.exe

pid	process
892	idrcdlnql.exe

pid	process
892	idrcdlnql.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\pbqrc\\agntoohgu.dll\",Verify"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\a:	rundll32.exe
File opened (read-only)	\??\i:	rundll32.exe
File opened (read-only)	\??\o:	rundll32.exe
File opened (read-only)	\??\p:	rundll32.exe
File opened (read-only)	\??\x:	rundll32.exe
File opened (read-only)	\??\z:	rundll32.exe
File opened (read-only)	\??\b:	rundll32.exe
File opened (read-only)	\??\n:	rundll32.exe
File opened (read-only)	\??\t:	rundll32.exe
File opened (read-only)	\??\v:	rundll32.exe
File opened (read-only)	\??\w:	rundll32.exe
File opened (read-only)	\??\y:	rundll32.exe
File opened (read-only)	\??\s:	rundll32.exe
File opened (read-only)	\??\g:	rundll32.exe
File opened (read-only)	\??\h:	rundll32.exe
File opened (read-only)	\??\j:	rundll32.exe
File opened (read-only)	\??\l:	rundll32.exe
File opened (read-only)	\??\m:	rundll32.exe
File opened (read-only)	\??\q:	rundll32.exe
File opened (read-only)	\??\r:	rundll32.exe
File opened (read-only)	\??\e:	rundll32.exe
File opened (read-only)	\??\k:	rundll32.exe
File opened (read-only)	\??\u:	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1252 rundll32.exe
Drops file in Program Files directory 2 IoCs

Processes:

idrcdlnql.exe

description ioc process

File opened for modification \??\c:\Program Files\pbqrc idrcdlnql.exe
File created \??\c:\Program Files\pbqrc\agntoohgu.dll idrcdlnql.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\pbqrc	idrcdlnql.exe
File created	\??\c:\Program Files\pbqrc\agntoohgu.dll	idrcdlnql.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4212 PING.EXE

pid	process
4212	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1252 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exeidrcdlnql.exe

pid process

4452 e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe
892 idrcdlnql.exe

description	pid	process
Token: SeDebugPrivilege	1252	rundll32.exe

pid	process
4452	e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe
892	idrcdlnql.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.execmd.exeidrcdlnql.exe

description	pid	process	target process
PID 4452 wrote to memory of 3824	4452	e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe	cmd.exe
PID 4452 wrote to memory of 3824	4452	e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe	cmd.exe
PID 4452 wrote to memory of 3824	4452	e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe	cmd.exe
PID 3824 wrote to memory of 4212	3824	cmd.exe	PING.EXE
PID 3824 wrote to memory of 4212	3824	cmd.exe	PING.EXE
PID 3824 wrote to memory of 4212	3824	cmd.exe	PING.EXE
PID 3824 wrote to memory of 892	3824	cmd.exe	idrcdlnql.exe
PID 3824 wrote to memory of 892	3824	cmd.exe	idrcdlnql.exe
PID 3824 wrote to memory of 892	3824	cmd.exe	idrcdlnql.exe
PID 892 wrote to memory of 1252	892	idrcdlnql.exe	rundll32.exe
PID 892 wrote to memory of 1252	892	idrcdlnql.exe	rundll32.exe
PID 892 wrote to memory of 1252	892	idrcdlnql.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe
"C:\Users\Admin\AppData\Local\Temp\e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\idrcdlnql.exe "C:\Users\Admin\AppData\Local\Temp\e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:4212

C:\Users\Admin\AppData\Local\Temp\idrcdlnql.exe
C:\Users\Admin\AppData\Local\Temp\\idrcdlnql.exe "C:\Users\Admin\AppData\Local\Temp\e7a0e631b207f9e3428036b2009e184bda1b0f750d4679e10da78e8fabcec171.exe"
3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892

\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\Program Files\pbqrc\agntoohgu.dll",Verify C:\Users\Admin\AppData\Local\Temp\idrcdlnql.exe
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4572,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\idrcdlnql.exe
Filesize
408KB

MD5
01a2b68c42beaaecfa471b120adc718a

SHA1
2e148d77f056cfb5ed39bb509caf60ce7b8b1131

SHA256
3fcdd22ffc47ed13d48d16d2754fb82774e568281176b3fa1af7511459c2d1e1

SHA512
30f1208f80ce76a6371810a069ab3aca15a2ee9c862417083ee067e500dded82b3b319db1ceec1bd1f785a3f6600531daa121ed638ee971adf9932ff989687e9

Download Submit
\??\c:\Program Files\pbqrc\agntoohgu.dll
Filesize
228KB

MD5
ccfc0443d9efb99dc8386a586eda721e

SHA1
52f779113332ebac74e4f906712089416653da35

SHA256
c5202ff18834dc64321e3ad71f3bed84d61ba9b8e60db11b2ea58816aeb44dbc

SHA512
37427730aca8de818bcf8cbe999abba3cc8b6cf8e8a79e1a100c9f325572364ee68da9e39379bb1d262c59013b872385956f73a70f0050fd785608854cc90c41

Download Submit
memory/892-6-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/892-8-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1252-11-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/1252-12-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/1252-14-0x0000000010000000-0x0000000010080000-memory.dmp

Filesize
512KB

Download
memory/4452-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4452-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download