Analysis
-
max time kernel
121s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 23:55
Static task
static1
Behavioral task
behavioral1
Sample
6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a.dll
Resource
win10v2004-20220812-en
General
-
Target
6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a.dll
-
Size
608KB
-
MD5
ab26341982c339f785ea74896a4d8a06
-
SHA1
12e496b01c32e7ff2675dd97c6deb01048a3615d
-
SHA256
6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a
-
SHA512
56f433cd1b1ce4a9fb6645b821740abb2cda9328d02446c51623031917aad49730a32687f6c6e4fdc3ac3ef4d2126603b492e48b3909af7785c03152ad2d1607
-
SSDEEP
12288:x01B1Rwqmt1AdX+QiTEMmMQ5GNn3Xuq/sA8Tkrxb:y5CqzdX+QPMmlUeiEkt
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 2004 1356 regsvr32.exe regsvr32.exe -
outlook_win_path 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6c5ff7e15f280212e6f5fb394b6c94b48e3afb359b9c7b15c0d3a81e3319943a.dll2⤵
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:2004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1356-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmpFilesize
8KB
-
memory/2004-55-0x0000000000000000-mapping.dmp
-
memory/2004-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/2004-57-0x0000000000661000-0x00000000006E3000-memory.dmpFilesize
520KB