d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167 | Triage™

Resubmissions

12/10/2021, 19:51

211012-yks25sdbf910

01/10/2021, 04:26

211001-e2kmjsahdl10

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-en-20210920
submitted
01/10/2021, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stage2.bin.dll
Size 76KB
Sample211001-e2kmjsahdl
SHA256 d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
MD5 e8ae3940c30296d494e534e0379f15d6
SHA1 3bcb5e7bc9c317c3c067f36d7684a419da79506c
SHA512 d07b8e684fc1c7a103b64b46d777091bb79103448e91f862c12f0080435feff1c9e907472b7fd4e236ff0b0a8e90dbbaaac202e2238f95578fed1ff6f5247386
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27
PID 1324 wrote to memory of 824	1324	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\stage2.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\stage2.bin.dll
  2⤵
  PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-56-0x0000000075661000-0x0000000075663000-memory.dmp

Download

memory/1324-54-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Download