e92099971841dad8535039e2da99cebeb0a8915a0a8c52a960c3f517208b4a59

Analysis

max time kernel
2s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e92099971841dad8535039e2da99cebeb0a8915a0a8c52a960c3f517208b4a59.dll
Size

114KB
MD5

3ccc04bbc74557ec390c807e7909c1f0
SHA1

ad9f3b1651ce0e99cdf6d6c91f26cfad306974a1
SHA256

e92099971841dad8535039e2da99cebeb0a8915a0a8c52a960c3f517208b4a59
SHA512

06ef88d1a4f9dbee01dc54b770e938c8d5e0ca639b0fb87415a177e78473e21e0c5cfc735569538ca58ad754096f5ac3991371a6a1594e1d4800a42ac536333c
SSDEEP

3072:IdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5KkiCbmN:Mpl2GkGMkSgb8Svlu5KkON

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{dmewrtrl-ycos-iqae-qefc-eytpvq2zxoqw}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{dmewrtrl-ycos-iqae-qefc-eytpvq2zxoqw}\ = "ÏµÍ³ÉèÖÃ"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{dmewrtrl-ycos-iqae-qefc-eytpvq2zxoqw}\stubpath = "þÿÿÿX"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28
PID 1336 wrote to memory of 1348	1336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92099971841dad8535039e2da99cebeb0a8915a0a8c52a960c3f517208b4a59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92099971841dad8535039e2da99cebeb0a8915a0a8c52a960c3f517208b4a59.dll,#1
  2⤵
  - Modifies Installed Components in the registry
  PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download