Analysis
-
max time kernel
238s -
max time network
321s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:08
Static task
static1
Behavioral task
behavioral1
Sample
AllVideoSoundExtractor/HA_AllVideoSoundExtractor23_WGL.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AllVideoSoundExtractor/HA_AllVideoSoundExtractor23_WGL.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
AllVideoSoundExtractor/lpk.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
AllVideoSoundExtractor/lpk.dll
Resource
win10v2004-20221111-en
General
-
Target
AllVideoSoundExtractor/lpk.dll
-
Size
46KB
-
MD5
77774d76e724ae9017bac8609947899c
-
SHA1
efd281c15cc901fee9c64f88fd0b74eb1fa82b57
-
SHA256
2017c37d13d1c5475cb1532f06a87ae60b1b5852a405a2b6c24d881efe7aba08
-
SHA512
68d88ff7c3e130f2ac25e73ba92398dd2b8a6dba26980395996ed6c8e7a4a404de30ce40f9819925afe55040c8f69e6461b7f8349d8de5f2ccdf19116407699f
-
SSDEEP
768:IUWUAohfjiT5ediDgEYe5eWomHEo2fKEFCLxu5qr7Ho73UEWkGpIfxMC:10qfWT5MbEYme9aLMBCVuEXID3x+C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
hrlA1EB.tmpomemiu.exepid process 1040 hrlA1EB.tmp 804 omemiu.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmp upx \Users\Admin\AppData\Local\Temp\hrlA1EB.tmp upx \Users\Admin\AppData\Local\Temp\hrlA1EB.tmp upx C:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmp upx behavioral3/memory/1040-62-0x0000000000400000-0x000000000041D000-memory.dmp upx C:\Windows\SysWOW64\omemiu.exe upx behavioral3/memory/1040-64-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral3/memory/804-65-0x0000000000400000-0x000000000041D000-memory.dmp upx C:\Windows\SysWOW64\omemiu.exe upx behavioral3/memory/804-69-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exeomemiu.exepid process 784 rundll32.exe 784 rundll32.exe 804 omemiu.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
omemiu.exedescription ioc process File opened (read-only) \??\X: omemiu.exe File opened (read-only) \??\F: omemiu.exe File opened (read-only) \??\L: omemiu.exe File opened (read-only) \??\P: omemiu.exe File opened (read-only) \??\N: omemiu.exe File opened (read-only) \??\R: omemiu.exe File opened (read-only) \??\U: omemiu.exe File opened (read-only) \??\Y: omemiu.exe File opened (read-only) \??\G: omemiu.exe File opened (read-only) \??\K: omemiu.exe File opened (read-only) \??\M: omemiu.exe File opened (read-only) \??\S: omemiu.exe File opened (read-only) \??\T: omemiu.exe File opened (read-only) \??\V: omemiu.exe File opened (read-only) \??\W: omemiu.exe File opened (read-only) \??\Z: omemiu.exe File opened (read-only) \??\I: omemiu.exe File opened (read-only) \??\J: omemiu.exe File opened (read-only) \??\Q: omemiu.exe File opened (read-only) \??\E: omemiu.exe File opened (read-only) \??\H: omemiu.exe File opened (read-only) \??\O: omemiu.exe -
Drops file in System32 directory 3 IoCs
Processes:
hrlA1EB.tmpomemiu.exedescription ioc process File created C:\Windows\SysWOW64\omemiu.exe hrlA1EB.tmp File opened for modification C:\Windows\SysWOW64\omemiu.exe hrlA1EB.tmp File created C:\Windows\SysWOW64\gei33.dll omemiu.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 524 wrote to memory of 784 524 rundll32.exe rundll32.exe PID 784 wrote to memory of 1040 784 rundll32.exe hrlA1EB.tmp PID 784 wrote to memory of 1040 784 rundll32.exe hrlA1EB.tmp PID 784 wrote to memory of 1040 784 rundll32.exe hrlA1EB.tmp PID 784 wrote to memory of 1040 784 rundll32.exe hrlA1EB.tmp
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AllVideoSoundExtractor\lpk.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\AllVideoSoundExtractor\lpk.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmpC:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\omemiu.exeC:\Windows\SysWOW64\omemiu.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmpFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
C:\Users\Admin\AppData\Local\Temp\hrlA1EB.tmpFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
C:\Windows\SysWOW64\omemiu.exeFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
C:\Windows\SysWOW64\omemiu.exeFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
\Users\Admin\AppData\Local\Temp\hrlA1EB.tmpFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
\Users\Admin\AppData\Local\Temp\hrlA1EB.tmpFilesize
33KB
MD51c5ff68d8d5bacf2524969da10883415
SHA13e3bd98a285bced519a81bd418a7a506e417c36e
SHA256686ce3c2b25244c8877d0e8db076055632039a55bba236843a5ef18e187feb0b
SHA512b10e5ae908f7e473f1314432227faa5e46615609384ebd4b82ccd3b1d5bc91d6e53662470a257e9f9c3c40983a081d609a7acae430edb0b6bfbe4fa30a89245f
-
\Windows\SysWOW64\gei33.dllFilesize
46KB
MD577774d76e724ae9017bac8609947899c
SHA1efd281c15cc901fee9c64f88fd0b74eb1fa82b57
SHA2562017c37d13d1c5475cb1532f06a87ae60b1b5852a405a2b6c24d881efe7aba08
SHA51268d88ff7c3e130f2ac25e73ba92398dd2b8a6dba26980395996ed6c8e7a4a404de30ce40f9819925afe55040c8f69e6461b7f8349d8de5f2ccdf19116407699f
-
memory/784-60-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/784-55-0x00000000767C1000-0x00000000767C3000-memory.dmpFilesize
8KB
-
memory/784-54-0x0000000000000000-mapping.dmp
-
memory/804-65-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/804-69-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1040-58-0x0000000000000000-mapping.dmp
-
memory/1040-62-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1040-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB