Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 10:23
Static task
static1
Behavioral task
behavioral1
Sample
0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495.dll
Resource
win10v2004-20220812-en
General
-
Target
0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495.dll
-
Size
1.1MB
-
MD5
ae25b6084ddc8642e282a503e4682068
-
SHA1
69a8f8188f697c0b6fce007a3ddaab148c012d60
-
SHA256
0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495
-
SHA512
dd47423fd15d17f581bfb86f04c97f970d935855f21d6e43a3dbf462e79529c95f820610b71366dde1db2dab6d3edc13bd943c8d9b06b32684f0395d14a528d7
-
SSDEEP
24576:CmMQMmZcMsBhiwHOfWrepFTERtXp4OOy6dmaQVVONX9R:CmMF1X9OfmepFIpsy+f
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 840 wrote to memory of 2612 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 2612 840 regsvr32.exe regsvr32.exe PID 840 wrote to memory of 2612 840 regsvr32.exe regsvr32.exe -
outlook_win_path 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495.dll1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0982c786a7269b1874b2dca685c35692fa25a1dbbdb53e8d7feaac024e6bc495.dll2⤵
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:2612