6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
Size

308KB
MD5

fd431911c3d81505582d94a8012a0010
SHA1

7a3bb1ccd1462eca839a433644f1b549e566b11b
SHA256

6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06
SHA512

de609bf3f30e5f782663f000eab65e3f4c209a536b64afbd543ab1a3a107c18953a2657581d73b156baa560f786f4197e2e5f38755f92ed902f0ec7d031a1c28
SSDEEP

6144:ra8z7NS9Sb15YmbdnpHQGHpU0GP+Bu+wLi109CzUZUwW6c5G2p0riWUY41bwrJRO:FzxSA/JpfHpzz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1916-0-0x00000000008E0000-0x0000000000900000-memory.dmp	upx

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID\ = "6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\ = "Webhook1001PV"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\Clsid\ = "{A717F661-41D3-11D8-9BD7-962A4BD65539}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ = "Webhook1001PV"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1916	1392	regsvr32.exe	87
PID 1392 wrote to memory of 1916	1392	regsvr32.exe	87
PID 1392 wrote to memory of 1916	1392	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
  2⤵
  - Modifies registry class
  PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-0-0x00000000008E0000-0x0000000000900000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads