Resubmissions

16-10-2023 15:02

231016-seepnshc51 10

16-10-2023 14:55

231016-sasezaba44 1

16-10-2023 14:14

231016-rj9vyage8y 1

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2023 15:02

General

  • Target

    mesoc.dll

  • Size

    778KB

  • MD5

    a443f1622069aab6d8939491859e7cdb

  • SHA1

    f5dc559c1a1dfc96dd768f0bbe3036625784039c

  • SHA256

    e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053

  • SHA512

    167c848eba8cf44b818484381e3bb2a4be009b95c7f3a0994e3a394cc3161345b0a79aa38466398f3aa710f538a4c67ca792fa5a431d8c153ca3bb10de5a9cb0

  • SSDEEP

    6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//f:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\mesoc.dll,#1
    1⤵
      PID:3752
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\system32\rundll32.exe
        rundll32 mesoc.dll scab /k haval462
        2⤵
          PID:1740
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GetDeny.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:1120

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads