e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

General

Target

e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db.dll
Size

64KB
MD5

31e39ba7b98cea68ba19bb674577e3e0
SHA1

e80efd8050454356d4d8bfaf1f0064874a2edf3a
SHA256

e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db
SHA512

fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1
SSDEEP

1536:v8Th3a/4odCeoySB9nQZDn+/b0MHTWcTuM7qiuqOhMry:6q/45eoP9nQN+4cz7qirOhMry

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\mvscrtz.dll	rundll32.exe
File opened for modification	C:\Windows\system\mvscrtz.dll	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{55CEE3FA-6DFB-4bc4-B63D-9EA3B63B8527} = "e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db.dll,1265770719,1458308057,-352895392"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1456 wrote to memory of 1532	1456	rundll32.exe	28
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29
PID 1532 wrote to memory of 1664	1532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db.dll,#1
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 shell32,Control_RunDLL "C:\Windows\system\mvscrtz.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
\Windows\system\mvscrtz.dll

Filesize
64KB

MD5
31e39ba7b98cea68ba19bb674577e3e0

SHA1
e80efd8050454356d4d8bfaf1f0064874a2edf3a

SHA256
e0bce62def43a2ee3b005e8c29c394b668accf3fa2bba8b27248f50c7e35d1db

SHA512
fa411cec3d1efaf4a1e596bec5f608a92d8adb369fa00eb22f71e6ad4301554fe6283649c8add98e4be2203e53154b58c619057ea8c96923a64b661949dab6f1

Download Submit
memory/1532-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1532-65-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1532-67-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1664-66-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing