Analysis
- max time kernel
130s - max time network
139s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/07/2021, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
nete5.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
nete5.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target nete5.dll
- Size 429KB
- Sample210722-sgre6vre36
- SHA256 f7594160c8df5c19d329c27fd3f49cb557afb36f5e34949eaf9ba575de8b9a93
- MD5 e967fa01c9bad22ae3d23d76ed61bc78
- SHA1 dc39453bb75f8ebab049e2d875d51853603c43b4
- SHA512 0b3ca070bcac217bb1ab02012bf6df187392f543767aa30b5e948a0787b807e73bcf34ad8d58f284629a9b22a440a34eea37361cd51d5648d3e4f688db9a5de9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 992 created 3020 992 regsvr32.exe 22 - suricata: ET MALWARE BazaLoader Activity (GET)
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 992 set thread context of 2268 992 regsvr32.exe 78 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 992 regsvr32.exe 992 regsvr32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78 PID 992 wrote to memory of 2268 992 regsvr32.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3020
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\nete5.dll2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:2268
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\nete5.dll"1⤵PID:764