2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01

General

Target

2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01.dll
Size

1.4MB
MD5

044aa925c5e48ace2661eb941859a786
SHA1

1ff565f40bf76dfb298918593ef3b3c7601f75a4
SHA256

2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01
SHA512

8d0a24191ff5e3e9de23d2de36ca4266f9a8afaeb2ba6c3bcc9d94148b0cafd1bcc196570562c0659f272273941ccd311744fa1b02c73da99afe6b2ece02b44c
SSDEEP

24576:FIUV+FOyGU1WIF6lBXr/iPy/7nu49VaVFHsK5SzBkezIR/hQUvMZiUCdFjP11zK:FIQ6OyGU4IFgoA7x9VcHSGphQXZiUq9O

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4748-133-0x0000000010000000-0x00000000101A2000-memory.dmp	upx

Modifies registry class 37 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ = "Isoft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib\ = "{EB702B11-1E39-5AB8-6231-2046AF7D3502}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft\CLSID\ = "{247AFDAA-485D-86D9-A93A-41B28AC21063}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\ProgID\ = "sdh.soft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib\ = "{EB702B11-1E39-5AB8-6231-2046AF7D3502}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft\ = "sdh.soft"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sdh.soft\CurVer\ = "sdh.soft"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ = "Isoft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\ = "sdh"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA41AB45-FD29-2654-6277-30808F98BA23}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{247AFDAA-485D-86D9-A93A-41B28AC21063}\ = "sdh.soft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB702B11-1E39-5AB8-6231-2046AF7D3502}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1164 wrote to memory of 4748	1164	regsvr32.exe	regsvr32.exe
PID 1164 wrote to memory of 4748	1164	regsvr32.exe	regsvr32.exe
PID 1164 wrote to memory of 4748	1164	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2eb41895874f8d2150c6dfc3a2c56c1d591b2607c4747a3eaf02b2e8c89f3b01.dll
2⤵
- Modifies registry class
PID:4748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4748-132-0x0000000000000000-mapping.dmp

Download
memory/4748-133-0x0000000010000000-0x00000000101A2000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads