660effaf33e85bc19be61ab5cfa64fc187bc9902317c292770a5a18683b000ed | Triage

Resubmissions

13-09-2021 11:20

210913-nfdrjsdee4 10

13-09-2021 09:09

210913-k4h5dsddd4 10

Analysis

max time kernel
435s
max time network
1711s
platform
windows10_x64
resource
win10-en
submitted
13-09-2021 11:20

Sharing

Report Analysis Logs

General

Target

vessel-64.dat.dll
Size

4.5MB
MD5

6d912f3cb045cfce88c96f0da2addf3b
SHA1

52286ca71ac4239c5e2faad25e569f83ca4b35ee
SHA256

7051f30a6b9c7826f017faf69fe52c6e28c71af1ef5e1dbaae9c6f8a885019a7
SHA512

e22e4b89a9f7f659d89949b18df93c24087eaffe7e1399d8ca9eaff3a941fa3e2c4945dea03ffa3fb087ffcaa30c9d16bd29ecc7e158b9e5e4c5eccd530312cd

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
3976 regsvr32.exe
3976 regsvr32.exe
3976 regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vessel-64.dat.dll
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...