c68e525872eea6c40b370ab5a4a661376b844a1fab836e6338fa1dbe22676806

Analysis

max time kernel
105s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68e525872eea6c40b370ab5a4a661376b844a1fab836e6338fa1dbe22676806.dll
Size

617KB
MD5

a8587e100b892ba7f6fe8171668396a1
SHA1

77841acb46a797695a418cd8b988c756beea6bed
SHA256

c68e525872eea6c40b370ab5a4a661376b844a1fab836e6338fa1dbe22676806
SHA512

1a8017c608738605c8227c3807842c4b6ddc046ea98dcd271c74b6f02c59949b89b3dca926e660deeeda5c3d1d52b553bc71b09364aadf4e81f6268e55e1946b
SSDEEP

12288:qNkFO7osNRaOTiBIEMiPkfdGV6KhQiRkW4u1:LUpTaOgSiPuEYKh/lR

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3704 wrote to memory of 4100	3704	regsvr32.exe	regsvr32.exe
PID 3704 wrote to memory of 4100	3704	regsvr32.exe	regsvr32.exe
PID 3704 wrote to memory of 4100	3704	regsvr32.exe	regsvr32.exe

outlook_win_path 1 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c68e525872eea6c40b370ab5a4a661376b844a1fab836e6338fa1dbe22676806.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c68e525872eea6c40b370ab5a4a661376b844a1fab836e6338fa1dbe22676806.dll
2⤵
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-132-0x0000000000000000-mapping.dmp

Download
memory/4100-133-0x0000000000890000-0x0000000000930000-memory.dmp

Filesize
640KB

Download