Analysis
-
max time kernel
1s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
11-04-2022 11:00
Behavioral task
behavioral1
Sample
DisReg.exe
Resource
win10-20220223-en
Behavioral task
behavioral2
Sample
DisReg.exe
Resource
win10v2004-20220331-en
Behavioral task
behavioral3
Sample
lib/basichttp.dll
Resource
win10-20220331-en
Behavioral task
behavioral4
Sample
lib/basichttp.dll
Resource
win10v2004-20220331-en
Behavioral task
behavioral5
Sample
lib/elevated.dll
Resource
win10-20220223-en
Behavioral task
behavioral6
Sample
lib/elevated.dll
Resource
win10v2004-20220331-en
Behavioral task
behavioral7
Sample
lib/extensions/AnyCaptchaCallbackHooker_Unpacked/generated/client/client.js
Resource
win10-20220331-en
Behavioral task
behavioral8
Sample
lib/extensions/AnyCaptchaCallbackHooker_Unpacked/generated/client/client.js
Resource
win10v2004-en-20220113
General
-
Target
lib/elevated.dll
-
Size
211KB
-
MD5
852cad9d8043b764e953e1d93df22b45
-
SHA1
f3ff1e36f8055acb634238ada2d2b085036c409b
-
SHA256
dab482fe4470073b051ee3dfff8bf852dfa74b3d784009476974c0f72729a35d
-
SHA512
438b6fd2b5969a97a449a66ea1f11fca414189158ac4ece2eea78f96a8d6954c30a0dc99d371bdf9b886b9b94a45c883acf339391997d2705529652efd099cb7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3120 wrote to memory of 2456 3120 regsvr32.exe regsvr32.exe PID 3120 wrote to memory of 2456 3120 regsvr32.exe regsvr32.exe PID 3120 wrote to memory of 2456 3120 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2456-114-0x0000000000000000-mapping.dmp