Analysis
-
max time kernel
50s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03-11-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
b0610bd86f59e7e8b80912faee325059946993b0c06b0538c2462a4115913e1d.dll
Resource
win10-20220901-en
windows10-1703-x64
5 signatures
150 seconds
General
-
Target
b0610bd86f59e7e8b80912faee325059946993b0c06b0538c2462a4115913e1d.dll
-
Size
818KB
-
MD5
44db592efd0170386505b7a0e7ea667b
-
SHA1
276c06e31d4068614476f66ce74911364d62a06f
-
SHA256
b0610bd86f59e7e8b80912faee325059946993b0c06b0538c2462a4115913e1d
-
SHA512
1b6ac73af2b0b48a3ef5a0ca4dcde76fbe0a4a7f100e45ec7e0626d999caeb964245fc235db64034ad30a10496b8e94d44676aed26b995ab40430cdbca8eee85
-
SSDEEP
12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1rVx48/2aS4/2YX:NYwIvxFMXn+L8zcZ7r3wC2Y
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZddlVJhXhwrcr.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NIZCIcMgtvemdplh\\ZddlVJhXhwrcr.dll\"" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4556 regsvr32.exe 4556 regsvr32.exe 4840 regsvr32.exe 4840 regsvr32.exe 4840 regsvr32.exe 4840 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4556 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4840 4556 regsvr32.exe 66 PID 4556 wrote to memory of 4840 4556 regsvr32.exe 66
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b0610bd86f59e7e8b80912faee325059946993b0c06b0538c2462a4115913e1d.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NIZCIcMgtvemdplh\ZddlVJhXhwrcr.dll"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4840
-