2da1d5ec8d9c73fe511d7dca1ccf2b9e00f0fb5ab0f41a97c5359d3d9ae68a09

Analysis

max time kernel
166s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2da1d5ec8d9c73fe511d7dca1ccf2b9e00f0fb5ab0f41a97c5359d3d9ae68a09.dll
Size

606KB
MD5

214f8f2c1f32401da92b8c705a527adf
SHA1

d02f1bc0502a261ab782f6292a1583f939204497
SHA256

2da1d5ec8d9c73fe511d7dca1ccf2b9e00f0fb5ab0f41a97c5359d3d9ae68a09
SHA512

f1cff12c2439b626b460765e22368911b9fa997190b81a95caa694b8d7241935d1e9d517e57c489cbd8ff9251c8194eac9ec8594b7a814690af0af4aaa80b87a
SSDEEP

12288:M4nVZwVq517r6gSTw4CcYZ+1ffrETF+tkwHTkrQ:FSVYr6gD4CVkegrk

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4296 wrote to memory of 3004	4296	regsvr32.exe	regsvr32.exe
PID 4296 wrote to memory of 3004	4296	regsvr32.exe	regsvr32.exe
PID 4296 wrote to memory of 3004	4296	regsvr32.exe	regsvr32.exe

outlook_win_path 1 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2da1d5ec8d9c73fe511d7dca1ccf2b9e00f0fb5ab0f41a97c5359d3d9ae68a09.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2da1d5ec8d9c73fe511d7dca1ccf2b9e00f0fb5ab0f41a97c5359d3d9ae68a09.dll
2⤵
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-132-0x0000000000000000-mapping.dmp

Download