Overview
overview
8Static
static
4Serilog.dll
windows7-x64
1Serilog.dll
windows10-2004-x64
1Setup.exe
windows7-x64
8Setup.exe
windows10-2004-x64
7Seven.dll
windows7-x64
1Seven.dll
windows10-2004-x64
1V2.dll
windows7-x64
1V2.dll
windows10-2004-x64
1d2.dll
windows7-x64
1d2.dll
windows10-2004-x64
1data/App/D...p2.scr
windows7-x64
data/App/D...p2.scr
windows10-2004-x64
data/App/D...p3.scr
windows7-x64
data/App/D...p3.scr
windows10-2004-x64
data/App/D...p5.scr
windows7-x64
data/App/D...p5.scr
windows10-2004-x64
data/App/D...p7.scr
windows7-x64
data/App/D...p7.scr
windows10-2004-x64
data/App/D...p8.scr
windows7-x64
data/App/D...p8.scr
windows10-2004-x64
data/App/D...p9.scr
windows7-x64
data/App/D...p9.scr
windows10-2004-x64
data/App/P...re.dll
windows7-x64
1data/App/P...re.dll
windows10-2004-x64
1data/App/P...pa.exe
windows7-x64
data/App/P...pa.exe
windows10-2004-x64
data/App/x...al.pdf
windows7-x64
1data/App/x...al.pdf
windows10-2004-x64
1data/App/x...ll.dll
windows7-x64
1data/App/x...ll.dll
windows10-2004-x64
1data/App/x...64.dll
windows7-x64
8data/App/x...64.dll
windows10-2004-x64
8Analysis
- max time kernel
101s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/10/2022, 13:25
Behavioral task
behavioral1
Sample
Serilog.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Serilog.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Seven.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
Seven.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
V2.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
V2.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
d2.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
d2.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap2.scr
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral12
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap2.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap3.scr
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral14
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap3.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap5.scr
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral16
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap5.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap7.scr
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral18
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap7.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap8.scr
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap8.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap9.scr
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral22
Sample
data/App/Documents/Image-Line/FL Studio/Settings/Browser/Snap9.scr
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
data/App/Program Files/Common Files/VST2/Propellerhead Software/ReWire/ReWire.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral24
Sample
data/App/Program Files/Common Files/VST2/Propellerhead Software/ReWire/ReWire.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
data/App/Program Files/Common Files/VST2/zalupa.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral26
Sample
data/App/Program Files/Common Files/VST2/zalupa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
data/App/x64/ASIO4ALL v2/ASIO4ALL v2 Instruction Manual.pdf
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral28
Sample
data/App/x64/ASIO4ALL v2/ASIO4ALL v2 Instruction Manual.pdf
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
data/App/x64/ASIO4ALL v2/asio4all.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral30
Sample
data/App/x64/ASIO4ALL v2/asio4all.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
data/App/x64/ASIO4ALL v2/asio4all64.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral32
Sample
data/App/x64/ASIO4ALL v2/asio4all64.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
- Target data/App/x64/ASIO4ALL v2/asio4all64.dll
- Size 142KB
- Sample221024-qn7eyagge3
- SHA256 5564e99ce1d0ec73e762156af09e3d22bfec7af6f1bdcabe81e64825c7ca53da
- MD5 74edb1ea4bee5a60a683b5bb801f3574
- SHA1 55b62e45e7cf3e4b7255c1f3841c886394c8d851
- SHA512 ff6b8ff3f7f68e2700591991a1b862b2c3311a349c27c0facd0a0277c6394e905162f0637ab48eaa94515af29700d2031838cdaf997f7d6c0d521e3a20114266
- SSDEEP 1536:DbF0z8pabtCmKHCZm8d4vzi7YetKrZECd/dUgRqXxJkCVmkcu32h:vJ8d4m7YrZL/y1Wu32
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\data\\App\\x64\\ASIO4ALL v2\\asio4all64.dll" regsvr32.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\data\\App\\x64\\ASIO4ALL v2\\asio4all64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2" regsvr32.exe