Resubmissions
19-07-2023 19:55
230719-ym6e9abd8t 1018-01-2022 01:24
220118-bswrnsfad4 1011-01-2022 17:47
220111-wc6l6ageg2 1Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-01-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll
Resource
win10-en-20211208
General
-
Target
c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll
-
Size
420KB
-
MD5
992cca48b7b010a27137992275187008
-
SHA1
ac3a13614dfeddde54fb749efea5dfa8440784b0
-
SHA256
c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339
-
SHA512
050e8f4bae119e4a81458a7da3d3bfe9c0e389f7e1b7d473524eb7c95428d0fd236433061826ae510e27abfc52c4435f2d4dd89ac4d7dd0670fafedd7f40a493
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1932 wrote to memory of 1116 1932 regsvr32.exe regsvr32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe PID 1116 wrote to memory of 2004 1116 regsvr32.exe rundll32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c5d20af08267d9a8db5267e3d48acd6cb2139e53dc11de274a70f7ccb148b339.dll",DllRegisterServer3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-56-0x0000000000000000-mapping.dmp
-
memory/1116-57-0x0000000076511000-0x0000000076513000-memory.dmpFilesize
8KB
-
memory/1116-59-0x0000000010025000-0x0000000010026000-memory.dmpFilesize
4KB
-
memory/1116-58-0x0000000010001000-0x0000000010025000-memory.dmpFilesize
144KB
-
memory/1932-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmpFilesize
8KB
-
memory/2004-60-0x0000000000000000-mapping.dmp