550187abd3b47d3796a1811dc016c935069ac631996de7cd428ae986b39b2107

Analysis

Target

XRqW4.exe.dll
Size

320KB
MD5

7ebb3ae8efec620294fdfa3e99da78ea
SHA1

a545d8cd080a7237465ba3c63f8119d03369e005
SHA256

550187abd3b47d3796a1811dc016c935069ac631996de7cd428ae986b39b2107
SHA512

aa5ee27c3f3b55beefdda9103b9b548af9f04b41535b9e74379c3c8ed5904519766de4321a995047a63d958dafc20f82607b09678cf09f1b24ca29bec5facb0c

Score

8^/10

Blacklisted process makes network request 6 IoCs

Processes:

msiexec.exe

flow pid process

16 1932 msiexec.exe
18 1932 msiexec.exe
20 1932 msiexec.exe
22 1932 msiexec.exe
24 1932 msiexec.exe
26 1932 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

regsvr32.exe

description pid process target process

PID 2128 set thread context of 1932 2128 regsvr32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1932 msiexec.exe
Token: SeSecurityPrivilege 1932 msiexec.exe

description	pid	process	target process
PID 2128 set thread context of 1932	2128	regsvr32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1932	msiexec.exe
Token: SeSecurityPrivilege	1932	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4092 wrote to memory of 2128	4092	regsvr32.exe	regsvr32.exe
PID 4092 wrote to memory of 2128	4092	regsvr32.exe	regsvr32.exe
PID 4092 wrote to memory of 2128	4092	regsvr32.exe	regsvr32.exe
PID 2128 wrote to memory of 1932	2128	regsvr32.exe	msiexec.exe
PID 2128 wrote to memory of 1932	2128	regsvr32.exe	msiexec.exe
PID 2128 wrote to memory of 1932	2128	regsvr32.exe	msiexec.exe
PID 2128 wrote to memory of 1932	2128	regsvr32.exe	msiexec.exe
PID 2128 wrote to memory of 1932	2128	regsvr32.exe	msiexec.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\XRqW4.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

memory/1932-3-0x0000000002F30000-0x0000000002F56000-memory.dmp

Filesize
152KB

Download
memory/1932-4-0x0000000000000000-mapping.dmp

Download
memory/2128-2-0x0000000000000000-mapping.dmp

Download