Resubmissions
09/11/2022, 18:23
221109-w1w3macgcm 1009/11/2022, 18:22
221109-wz59xabba4 309/11/2022, 18:17
221109-ww6fhabah3 328/10/2022, 09:42
221028-lpl36sffgm 828/10/2022, 09:33
221028-ljk9pafbh9 828/10/2022, 09:23
221028-lct81sfbf5 8Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/resentful.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/resentful.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/staunchly.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
disallowable/staunchly.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
disallowable/staunchly.dll
-
Size
422KB
-
MD5
e9d9e1b1bb8b47e84448b4e6c91c8a70
-
SHA1
d1f91902916c2c7f5bb70dca73e0ca82205bbf68
-
SHA256
9eb14f1275869b04117098b4b6ef71c0ccf33366f96c9ca8f22b2132762eb6d0
-
SHA512
3fb05d0a65693233c34569bd8d24ef74eb62658c74309f79dda229504f33da123aa1305dc775a25690ffcf51ca9bd029cab21dc9d9a79bf4c0fc20a255ae6d52
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNjno8Ywr6t57AKC:eqdclafl4eGXuiNo8Ye6c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1848 regsvr32.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe 1216 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1848 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1088 wrote to memory of 1848 1088 regsvr32.exe 28 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29 PID 1848 wrote to memory of 1216 1848 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\staunchly.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\staunchly.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216
-
-