Analysis
-
max time kernel
253s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-07-2021 08:36
Static task
static1
Behavioral task
behavioral1
Sample
iCoreBr.jpg.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
iCoreBr.jpg.dll
Resource
win10v20210410
General
-
Target
iCoreBr.jpg.dll
-
Size
1.3MB
-
MD5
132e6560ca121679635684e812586bba
-
SHA1
6f48b7929e65aac27f3bf3cce24c7ad40624dc74
-
SHA256
c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
-
SHA512
3c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 848 created 1208 848 regsvr32.exe Explorer.EXE -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 848 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\RealtechUpdate = "\"C:\\Windows\\system32\\regsvr32.exe\" /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Damp\\ixswdpbvpsyhy.exe\" mscp arih" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 848 set thread context of 1128 848 regsvr32.exe chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1700 regsvr32.exe 848 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 1700 regsvr32.exe 848 regsvr32.exe 848 regsvr32.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
regsvr32.execmd.exeregsvr32.execmd.execmd.exeregsvr32.execmd.execmd.exedescription pid process target process PID 1648 wrote to memory of 648 1648 regsvr32.exe cmd.exe PID 1648 wrote to memory of 648 1648 regsvr32.exe cmd.exe PID 1648 wrote to memory of 648 1648 regsvr32.exe cmd.exe PID 648 wrote to memory of 768 648 cmd.exe PING.EXE PID 648 wrote to memory of 768 648 cmd.exe PING.EXE PID 648 wrote to memory of 768 648 cmd.exe PING.EXE PID 648 wrote to memory of 1700 648 cmd.exe regsvr32.exe PID 648 wrote to memory of 1700 648 cmd.exe regsvr32.exe PID 648 wrote to memory of 1700 648 cmd.exe regsvr32.exe PID 648 wrote to memory of 1700 648 cmd.exe regsvr32.exe PID 648 wrote to memory of 1700 648 cmd.exe regsvr32.exe PID 1700 wrote to memory of 1084 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1084 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1084 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1292 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1292 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1292 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1300 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1300 1700 regsvr32.exe cmd.exe PID 1700 wrote to memory of 1300 1700 regsvr32.exe cmd.exe PID 1292 wrote to memory of 300 1292 cmd.exe reg.exe PID 1292 wrote to memory of 300 1292 cmd.exe reg.exe PID 1292 wrote to memory of 300 1292 cmd.exe reg.exe PID 1300 wrote to memory of 664 1300 cmd.exe PING.EXE PID 1300 wrote to memory of 664 1300 cmd.exe PING.EXE PID 1300 wrote to memory of 664 1300 cmd.exe PING.EXE PID 1300 wrote to memory of 848 1300 cmd.exe regsvr32.exe PID 1300 wrote to memory of 848 1300 cmd.exe regsvr32.exe PID 1300 wrote to memory of 848 1300 cmd.exe regsvr32.exe PID 1300 wrote to memory of 848 1300 cmd.exe regsvr32.exe PID 1300 wrote to memory of 848 1300 cmd.exe regsvr32.exe PID 848 wrote to memory of 1536 848 regsvr32.exe cmd.exe PID 848 wrote to memory of 1536 848 regsvr32.exe cmd.exe PID 848 wrote to memory of 1536 848 regsvr32.exe cmd.exe PID 1536 wrote to memory of 744 1536 cmd.exe reg.exe PID 1536 wrote to memory of 744 1536 cmd.exe reg.exe PID 1536 wrote to memory of 744 1536 cmd.exe reg.exe PID 848 wrote to memory of 1608 848 regsvr32.exe cmd.exe PID 848 wrote to memory of 1608 848 regsvr32.exe cmd.exe PID 848 wrote to memory of 1608 848 regsvr32.exe cmd.exe PID 1608 wrote to memory of 1792 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1792 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1792 1608 cmd.exe reg.exe PID 848 wrote to memory of 1128 848 regsvr32.exe chrome.exe PID 848 wrote to memory of 1128 848 regsvr32.exe chrome.exe PID 848 wrote to memory of 1128 848 regsvr32.exe chrome.exe PID 848 wrote to memory of 1128 848 regsvr32.exe chrome.exe PID 848 wrote to memory of 1128 848 regsvr32.exe chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll" mscp ahis & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 84⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\iCoreBr.jpg.dll" mscp ahis4⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c echo %temp%5⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exe\" mscp arih"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v RealtechUpdate /t REG_SZ /d "\"C:\Windows\system32\regsvr32.exe\" /s \"C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exe\" mscp arih"6⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\system32\cmd.execmd /c ping 127.0.0.1 -n 8 & "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exe" mscp arih & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 86⤵
- Runs ping.exe
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exe" mscp arih6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"8⤵
-
C:\Windows\system32\cmd.execmd.exe /c reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /v "Path"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /v "Path"8⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" mscp amw fkprm "C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exeMD5
132e6560ca121679635684e812586bba
SHA16f48b7929e65aac27f3bf3cce24c7ad40624dc74
SHA256c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
SHA5123c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
-
\Users\Admin\AppData\Local\Temp\Damp\ixswdpbvpsyhy.exeMD5
132e6560ca121679635684e812586bba
SHA16f48b7929e65aac27f3bf3cce24c7ad40624dc74
SHA256c882f778e40b276c90d467816deda7605d9955e4302aa6ab7467aeae3f155048
SHA5123c3fd439c29e36a2ef174f82c4df36c89a87bbc2e280753166bc25b14b6066fc6b0eff7101e4b301e51722271b76ebdb79dbf58a201a7a4c8bcb64e708e6a4a5
-
memory/300-70-0x0000000000000000-mapping.dmp
-
memory/648-62-0x0000000000000000-mapping.dmp
-
memory/664-71-0x0000000000000000-mapping.dmp
-
memory/744-78-0x0000000000000000-mapping.dmp
-
memory/768-63-0x0000000000000000-mapping.dmp
-
memory/848-76-0x0000000001D90000-0x0000000001DF4000-memory.dmpFilesize
400KB
-
memory/848-72-0x0000000000000000-mapping.dmp
-
memory/1084-67-0x0000000000000000-mapping.dmp
-
memory/1128-83-0x00000000009E0000-0x0000000000B83000-memory.dmpFilesize
1.6MB
-
memory/1128-82-0x0000000000B82020-mapping.dmp
-
memory/1128-84-0x0000000029020000-0x0000000029084000-memory.dmpFilesize
400KB
-
memory/1128-81-0x00000000009E0000-0x0000000000B83000-memory.dmpFilesize
1.6MB
-
memory/1292-68-0x0000000000000000-mapping.dmp
-
memory/1300-69-0x0000000000000000-mapping.dmp
-
memory/1536-77-0x0000000000000000-mapping.dmp
-
memory/1608-79-0x0000000000000000-mapping.dmp
-
memory/1648-60-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB
-
memory/1648-61-0x0000000001F40000-0x0000000001FA4000-memory.dmpFilesize
400KB
-
memory/1700-66-0x00000000020E0000-0x0000000002144000-memory.dmpFilesize
400KB
-
memory/1700-64-0x0000000000000000-mapping.dmp
-
memory/1792-80-0x0000000000000000-mapping.dmp