LetsDefend — SOC319 — Suspicious DLL Execution Detected

This write-up documents my investigation of a security alert triggered in the LetsDefend platform.

First i take the ownership this alert. Before start investigation i need to understand context. What happened.

On the Ross machine the rundll32.exe process, which is normally used to load and execute functions from dynamic link libraries (DLLs), is attempting to execute a file with a non-standard extension

✅ Trigger Command: rundll32 c:\wnd\3291.png,GetModuleProp

✅Process Name: RUNDLL32.EXE

✅IP Address: 172.16.17.122

✅Hostname: Ross

L1 Mentioned the victim received an email from ‘support@mail.westcapitalreserve.com’. An .zip file name perspiciatisim.zip in the email

1- Initial Access

I first went to Email Security page and look at the received email from support@mail.westcapitalreserve.com. And to look and investigate attachment i downloaded attachment file.

Into the this zip file include an .iso file name PERSPICIATISM

Now i move to Log Managament section on the LetsDefend, i need to check victim open this file and extract an file.

I filtered by Src Address contains victim address, sort date column old to new. If you want to be sure you can start VM and look at the Sysmon Logs.

Downloaded Attachment File via Received Phishing Mail

Extracted .ISO file over .ZIP file

Files extracted from .ISO files

.EXE File Executed

Command Execution

We can say victim download an .zip file and extracted this zip file and created file name Open_Document.exe and executed this file. And then we can saw this .exe file execute few powershell commands.

Executed Commands:

With this .exe file a file with .png extension is downloaded using the curl command. If you look closely you can see that the Parent Process has an Open_Document.exe file.

Requested URL: yourunitedlaws.com/mrD/4462

Downloaded Payload: 3291.png

To connect this URL victim machine sent DNS Query with this domain yourunitedlaws[.]com

QueryName: yourunitedlaws.com

QueryResult: 50.3.132.236

If you research this url on the VT you can see this URL is malicious.

Defense Evasion

This downloaded file executed via rundll32. This look like LOLBINS because attacker downloaded suspicious look like .png file and ran with rundll32. And also called GetModuleProp function on the .png file. What was that? This is malicious. To verify

In other words, GetModuleProp is the very main function that was written by the attacker and exported (as an exported function) within that fake PNG file (which is actually a DLL). It is the malware’s ‘start’ button.

Now i need to identify what is this tactic for defense evasion, i moved LOLBas and search rundll32.

Containment

Analyst Note

T1566.001 — Initial Access: Spearphishing Attachment T1574 — Defense Evasion: Hijack Execution Flow T1218.011 — Defense Evasion: System Binary Proxy Execution T1105: Command and Control: Ingress Tool Transfer T1204.002 — Execution: User Execution

✅What: A multi stage malware infection was identified on host Ross. initiated via a phishing email delivering a malicious ISO file. The ISO contained a weaponized Word document that, upon opening triggered a curl download of a seconf stage payload disguised as a PNG file. This paylad was then executed via rundll32.exe.

✅When:

• Sep, 09, 2024, 09:11 AM — Phishing Email received from support@mail.westcapitalreserve.com
• Shortly after — ZIP attachment extracted malicious ISO mounted
• This ISO file extracted and some files appears these ISO contents
• cmd.exe executed and triggered curl.exe to download stage 2 payload 3291.png
• Sep, 09, 2024, 10:17 AM — rundll32 c:\wnd\3291.png,GetModuleProp

✅Where: -Hostname: Ross -IP Address: 172.16.17.122 -File Path: C:\Users\LetsDefend\Downloads\perspiciatism\PERSPICIATISM\

✅Who: -Recipient/Victim: ross@letsdefend[.]io -Sender: support@mail[.]westcapitalreserve[.]com

✅Why: This phishing email is the beginning of a malware infiltration process, tricking victims into downloading and running an attached file. Once the victim downloads and runs the file, the malware performs various operations, downloading payloads from external sources and executing them alongside legitimate processes to evade security.

✅IOCs:

• support@mail[.]westcapitalreserve[.]com
• hxxps[://]yourunitedlaws[.]com/mrD/4462
• perspiciatism[.]zip
• 3291[.]zip
• 172[.]16[.]17[.]122
• 50[.]3[.]132[.]236