Overview
overview
6Static
static
autocopy/A...ss.dll
windows7-x64
1autocopy/A...ss.dll
windows10-2004-x64
1autocopy/AutoCopy.exe
windows7-x64
6autocopy/AutoCopy.exe
windows10-2004-x64
6autocopy/MSVBVM60.dll
windows7-x64
1autocopy/MSVBVM60.dll
windows10-2004-x64
1autocopy/diskcopy.dll
windows7-x64
1autocopy/diskcopy.dll
windows10-2004-x64
1autocopy/�...��.url
windows7-x64
1autocopy/�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 22:18
Static task
static1
Behavioral task
behavioral1
Sample
autocopy/ArmAccess.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
autocopy/ArmAccess.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
autocopy/AutoCopy.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
autocopy/AutoCopy.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
autocopy/MSVBVM60.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
autocopy/MSVBVM60.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
autocopy/diskcopy.dll
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
autocopy/diskcopy.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
autocopy/最火软件站.url
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
autocopy/最火软件站.url
Resource
win10v2004-20220812-en
General
-
Target
autocopy/ArmAccess.dll
-
Size
52KB
-
MD5
c841204b08d5a330f4e0503430f82e24
-
SHA1
5720d7eba4fdae55a7e67cfe3637cfda02d2e953
-
SHA256
089869db6efb52ce41dc6f0ab859164c7a316f4ae082cdc45b1ea7921fd42505
-
SHA512
22542300bc25ea84906c2ec7fd0588a9be67f9c44732f1c9c3ac8f2049a1941f2c746888c5635beb6a00049743cbb322143d698af7d501e9f5fc17738900e9ea
-
SSDEEP
384:TWNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oqee:SIwTulXtkmfZBe7EtFovs2I38ozSihb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 5080 wrote to memory of 2276 5080 regsvr32.exe regsvr32.exe PID 5080 wrote to memory of 2276 5080 regsvr32.exe regsvr32.exe PID 5080 wrote to memory of 2276 5080 regsvr32.exe regsvr32.exe