Overview
overview
10Static
static
10COMDLG32.dll
windows7-x64
1COMDLG32.dll
windows10-2004-x64
1MSADODC.dll
windows7-x64
1MSADODC.dll
windows10-2004-x64
1MSBIND.dll
windows7-x64
1MSBIND.dll
windows10-2004-x64
1MSCOMCT2.dll
windows7-x64
1MSCOMCT2.dll
windows10-2004-x64
1MSCOMCTL.dll
windows7-x64
1MSCOMCTL.dll
windows10-2004-x64
1MSDATGRD.dll
windows7-x64
1MSDATGRD.dll
windows10-2004-x64
1MSSTDFMT.dll
windows7-x64
1MSSTDFMT.dll
windows10-2004-x64
1MSWINSCK.dll
windows7-x64
1MSWINSCK.dll
windows10-2004-x64
1Readme-说明.htm
windows7-x64
1Readme-说明.htm
windows10-2004-x64
1jmail.dll
windows7-x64
1jmail.dll
windows10-2004-x64
1run.exe
windows7-x64
10run.exe
windows10-2004-x64
10yuren2008.exe
windows7-x64
yuren2008.exe
windows10-2004-x64
1Analysis
-
max time kernel
219s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 16:25
Behavioral task
behavioral1
Sample
COMDLG32.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
COMDLG32.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
MSADODC.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
MSADODC.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
MSBIND.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
MSBIND.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
MSCOMCT2.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
MSCOMCT2.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
MSCOMCTL.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
MSCOMCTL.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
MSDATGRD.dll
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
MSDATGRD.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
MSSTDFMT.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
MSSTDFMT.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
MSWINSCK.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
MSWINSCK.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Readme-说明.htm
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Readme-说明.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
jmail.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
jmail.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
run.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
run.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
yuren2008.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
yuren2008.exe
Resource
win10v2004-20221111-en
General
-
Target
COMDLG32.dll
-
Size
137KB
-
MD5
d76f0eab36f83a31d411aeaf70da7396
-
SHA1
9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
-
SHA256
46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
-
SHA512
9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
-
SSDEEP
3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3332 wrote to memory of 5116 3332 regsvr32.exe regsvr32.exe PID 3332 wrote to memory of 5116 3332 regsvr32.exe regsvr32.exe PID 3332 wrote to memory of 5116 3332 regsvr32.exe regsvr32.exe