Analysis
-
max time kernel
138s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
nady6.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
nady6.dll
Resource
win10v20210408
General
-
Target
nady6.dll
-
Size
1.3MB
-
MD5
1f45bcf1fb8b7ef74a57d19a371f41cf
-
SHA1
9b7f346a04f8481c22fb6f8853f76349402a7009
-
SHA256
aee116011409a5bec7d356bd8f704df0a361fb029bf20178d49e02607798d9a1
-
SHA512
6cdbc392b650420d9238d7400956fa41ec9ede827576b9023b977e232dd18b3dd72f36082fc6cdb5af7f62868b0bd00e9b718522799467c674efb6202a169f9f
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 3756 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\RealtechUpdate = "\"C:\\Windows\\system32\\regsvr32.exe\" /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Damp\\dmudgtodyraq.exe\" mscp arih" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2772 regsvr32.exe 2772 regsvr32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
regsvr32.execmd.exeregsvr32.execmd.execmd.exedescription pid process target process PID 992 wrote to memory of 2952 992 regsvr32.exe cmd.exe PID 992 wrote to memory of 2952 992 regsvr32.exe cmd.exe PID 2952 wrote to memory of 2228 2952 cmd.exe PING.EXE PID 2952 wrote to memory of 2228 2952 cmd.exe PING.EXE PID 2952 wrote to memory of 2772 2952 cmd.exe regsvr32.exe PID 2952 wrote to memory of 2772 2952 cmd.exe regsvr32.exe PID 2772 wrote to memory of 2108 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 2108 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 1816 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 1816 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 2764 2772 regsvr32.exe cmd.exe PID 2772 wrote to memory of 2764 2772 regsvr32.exe cmd.exe PID 2764 wrote to memory of 3236 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 3236 2764 cmd.exe PING.EXE PID 1816 wrote to memory of 3880 1816 cmd.exe reg.exe PID 1816 wrote to memory of 3880 1816 cmd.exe reg.exe PID 2764 wrote to memory of 3756 2764 cmd.exe regsvr32.exe PID 2764 wrote to memory of 3756 2764 cmd.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\nady6.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\nady6.dll" mscp ahis & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\nady6.dll" mscp ahis3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c echo %temp%4⤵
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exe" mscp arih & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exe" mscp arih5⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exe\" mscp arih"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exe\" mscp arih"5⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exeMD5
1f45bcf1fb8b7ef74a57d19a371f41cf
SHA19b7f346a04f8481c22fb6f8853f76349402a7009
SHA256aee116011409a5bec7d356bd8f704df0a361fb029bf20178d49e02607798d9a1
SHA5126cdbc392b650420d9238d7400956fa41ec9ede827576b9023b977e232dd18b3dd72f36082fc6cdb5af7f62868b0bd00e9b718522799467c674efb6202a169f9f
-
\Users\Admin\AppData\Local\Temp\Damp\dmudgtodyraq.exeMD5
1f45bcf1fb8b7ef74a57d19a371f41cf
SHA19b7f346a04f8481c22fb6f8853f76349402a7009
SHA256aee116011409a5bec7d356bd8f704df0a361fb029bf20178d49e02607798d9a1
SHA5126cdbc392b650420d9238d7400956fa41ec9ede827576b9023b977e232dd18b3dd72f36082fc6cdb5af7f62868b0bd00e9b718522799467c674efb6202a169f9f
-
memory/992-118-0x0000000028320000-0x0000000028384000-memory.dmpFilesize
400KB
-
memory/1816-128-0x0000000000000000-mapping.dmp
-
memory/2108-127-0x0000000000000000-mapping.dmp
-
memory/2228-120-0x0000000000000000-mapping.dmp
-
memory/2764-129-0x0000000000000000-mapping.dmp
-
memory/2772-123-0x00000000010D0000-0x00000000010D2000-memory.dmpFilesize
8KB
-
memory/2772-126-0x00000000282A0000-0x0000000028304000-memory.dmpFilesize
400KB
-
memory/2772-124-0x00000000010D0000-0x00000000010D2000-memory.dmpFilesize
8KB
-
memory/2772-125-0x00000000010D0000-0x00000000010D2000-memory.dmpFilesize
8KB
-
memory/2772-121-0x0000000000000000-mapping.dmp
-
memory/2952-119-0x0000000000000000-mapping.dmp
-
memory/3236-130-0x0000000000000000-mapping.dmp
-
memory/3756-132-0x0000000000000000-mapping.dmp
-
memory/3756-139-0x0000000027950000-0x00000000279B4000-memory.dmpFilesize
400KB
-
memory/3880-131-0x0000000000000000-mapping.dmp