Overview
overview
10Static
static
4Installer.exe
windows7-x64
10Installer.exe
windows10-2004-x64
10packages/A...er.exe
windows7-x64
1packages/A...er.exe
windows10-2004-x64
1packages/P...te.url
windows7-x64
1packages/P...te.url
windows10-2004-x64
1packages/P...el.exe
windows7-x64
1packages/P...el.exe
windows10-2004-x64
1packages/P...64.exe
windows7-x64
1packages/P...64.exe
windows10-2004-x64
1packages/P...re.dll
windows7-x64
1packages/P...re.dll
windows10-2004-x64
1packages/P...i).dll
windows7-x64
3packages/P...i).dll
windows10-2004-x64
3packages/P...Ti.dll
windows7-x64
3packages/P...Ti.dll
windows10-2004-x64
3Analysis
-
max time kernel
77s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2022 14:42
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
packages/AppInfo/Microsoft Analysis Services/AS OLEDB/110/SQLDumper.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
packages/AppInfo/Microsoft Analysis Services/AS OLEDB/110/SQLDumper.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
packages/Program Files (x86)/ASIO4ALL v2/ASIO4ALL Web Site.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
packages/Program Files (x86)/ASIO4ALL v2/ASIO4ALL Web Site.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
packages/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
packages/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
packages/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
packages/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
packages/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
packages/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
packages/Program Files (x86)/VstPlugins/FL Studio VSTi (Multi).dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
packages/Program Files (x86)/VstPlugins/FL Studio VSTi (Multi).dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
packages/Program Files (x86)/VstPlugins/FL Studio VSTi.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
packages/Program Files (x86)/VstPlugins/FL Studio VSTi.dll
Resource
win10v2004-20220812-en
General
-
Target
packages/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
-
Size
1.4MB
-
MD5
2f3f103405dec980cfa432ea93f92321
-
SHA1
4dc93f9aaba768a9c7d0473168831fe15d48fc85
-
SHA256
5b2c3a6727e4d1fcadec1e1ea0fa6055d1d041a52211cc75c2b0330f6a1754df
-
SHA512
4f7704bd77e336c11cc96f1dd45e2f4e98d78421b12696b89b887fec17027d543de0964177cc40114edb8c5b16b148ad24bb6e5bc9a09fce23f7daa34db5eb8f
-
SSDEEP
24576:uFxEKn67lrLcZNOHMpOn/rG6V0xmPyMbNzb:uo7Fg/pC2xm6yzb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4272 wrote to memory of 612 4272 rundll32.exe rundll32.exe PID 4272 wrote to memory of 612 4272 rundll32.exe rundll32.exe PID 4272 wrote to memory of 612 4272 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\Common Files\Propellerhead Software\ReWire\ReWire.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\Common Files\Propellerhead Software\ReWire\ReWire.dll",#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/612-132-0x0000000000000000-mapping.dmp