6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3

Submit
Reports

Overview

overview

Static

static

1814a6a674...67.exe

windows7_x64

1814a6a674...67.exe

windows10_x64

2ca4f97e15...51.exe

windows7_x64

2ca4f97e15...51.exe

windows10_x64

3db6e8df73...3b.dll

windows7_x64

3db6e8df73...3b.dll

windows10_x64

3e2ce6fd7b...a5.exe

windows7_x64

3e2ce6fd7b...a5.exe

windows10_x64

463b34821a...40.exe

windows7_x64

463b34821a...40.exe

windows10_x64

4f4a33f700...72.exe

windows7_x64

4f4a33f700...72.exe

windows10_x64

53b1c1b2f4...22.exe

windows7_x64

53b1c1b2f4...22.exe

windows10_x64

62b2822215...d3.exe

windows7_x64

62b2822215...d3.exe

windows10_x64

6bc6f60b87...bc.dll

windows7_x64

6bc6f60b87...bc.dll

windows10_x64

6f7043b24d...1d.dll

windows7_x64

6f7043b24d...1d.dll

windows10_x64

706a8a4fc4...1c.exe

windows7_x64

706a8a4fc4...1c.exe

windows10_x64

7236c8098c...8e.exe

windows7_x64

7236c8098c...8e.exe

windows10_x64

74ebfcd116...dd.dll

windows7_x64

74ebfcd116...dd.dll

windows10_x64

7fbeac1dca...de.exe

windows7_x64

7fbeac1dca...de.exe

windows10_x64

87e6f7b20e...89.exe

windows7_x64

87e6f7b20e...89.exe

windows10_x64

918127c59e...3d.exe

windows7_x64

918127c59e...3d.exe

windows10_x64

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 10:27

Sharing

Copy URL

Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

Resource

win7-en-20210920

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

Resource

win10v20210408

magniber ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral3

Sample

2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe

Resource

win7-en-20210920

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral4

Sample

2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe

Resource

win10v20210408

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral5

Sample

3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll

Resource

win7-en-20210920

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral6

Sample

3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll

Resource

win10v20210408

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral7

Sample

3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe

Resource

win7-en-20210920

conti ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral8

Sample

3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe

Resource

win10v20210408

conti ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral9

Sample

463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe

Resource

win7-en-20210920

magniber ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral10

Sample

463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe

Resource

win10-en-20210920

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral11

Sample

4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe

Resource

win7v20210408

conti ransomware spyware stealer vmprotect

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral12

Sample

4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe

Resource

win10-en-20210920

vmprotect

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral13

Sample

53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe

Resource

win7v20210408

conti ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral14

Sample

53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe

Resource

win10-en-20210920

conti ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral15

Sample

62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe

Resource

win7-en-20210920

evasion themida trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral16

Sample

62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe

Resource

win10v20210408

evasion themida trojan

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral17

Sample

6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll

Resource

win7-en-20210920

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral18

Sample

6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll

Resource

win10v20210408

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral19

Sample

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll

Resource

win7-en-20210920

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral20

Sample

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral21

Sample

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

Resource

win7-en-20210920

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral22

Sample

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

Resource

win10v20210408

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral23

Sample

7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe

Resource

win7-en-20210920

conti ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral24

Sample

7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe

Resource

win10-en-20210920

conti ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral25

Sample

74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll

Resource

win7v20210408

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral26

Sample

74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll

Resource

win10-en-20210920

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral27

Sample

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

Resource

win7v20210408

conti ransomware

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral28

Sample

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

Resource

win10-en-20210920

conti ransomware

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral29

Sample

87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe

Resource

win7-en-20210920

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral30

Sample

87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Behavioral task

behavioral31

Sample

918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe

Resource

win7-en-20210920

conti ransomware spyware stealer

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral32

Sample

918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe

Resource

win10v20210408

conti ransomware spyware stealer

windows10_x64

0 signatures

0 seconds

Report Analysis Logs

General

Target

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Size

200KB
MD5

d7bf01f9fb24176f2d42d770d79e8c2c
SHA1

9b8eeaf746cd5d903f70c3b245b9466c40b74c5d
SHA256

6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d
SHA512

0f299b9637c92098eda3a0d27a384e62d9fbaac4a2042cce84f5b1437eea1a17534331931ea5e6a68d79077cefb8678411900165b79fb4040578afaef354ee79

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe
PID 2040 wrote to memory of 1264	2040	regsvr32.exe	regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
2⤵
PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-55-0x0000000000000000-mapping.dmp

Download
memory/1264-56-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download