ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4

General
Target

ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4.dll

Filesize

574KB

Completed

15-01-2022 01:18

Score
1/10
MD5

fe713c9b190b703b8cf71497e6bb485c

SHA1

a0896f80f892d053038bbef122a9a6844fd3a29c

SHA256

ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4

Malware Config
Signatures 1

Filter: none

  • Suspicious use of WriteProcessMemory
    regsvr32.exeregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1384 wrote to memory of 13001384regsvr32.exeregsvr32.exe
    PID 1384 wrote to memory of 13001384regsvr32.exeregsvr32.exe
    PID 1384 wrote to memory of 13001384regsvr32.exeregsvr32.exe
    PID 1300 wrote to memory of 14921300regsvr32.exerundll32.exe
    PID 1300 wrote to memory of 14921300regsvr32.exerundll32.exe
    PID 1300 wrote to memory of 14921300regsvr32.exerundll32.exe
Processes 3
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4.dll
    Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4.dll
      Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ba0a0438694f2b82e709c946cf086a000c9a8030811d4bd9c8216067f29ddcc4.dll",DllRegisterServer
        PID:1492
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/1300-115-0x0000000000000000-mapping.dmp

                            Download

                          • memory/1300-117-0x0000000003465000-0x0000000003466000-memory.dmp

                            Download

                          • memory/1300-116-0x0000000003441000-0x0000000003465000-memory.dmp

                            Download

                          • memory/1492-118-0x0000000000000000-mapping.dmp

                            Download