0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 08:59

Sharing

Report Analysis Logs

General

Target

weasel.dll
Size

834KB
MD5

5a905d252c8a73c6dc79ac89038a71f4
SHA1

4e73778dfdb8dcf5a32f3ca9a75ed1b7f65c8058
SHA256

391bf397df1af7efcd78b87f5e551e0a23d8b4e73261b37367e47cb84997cabf
SHA512

945474a9043bbf83c485130699eaf6179e998f200fdcad6647f5991d13caaac052a6783610ed5fed251b2c4375ad28d3e8ae9c4d03063362187d70e921ab3887
SSDEEP

12288:BLI4zGR2ExV87z+lxvhiYmjqEl3DOaDPmWXY3Usk5XgIK:BLIfV87z+lxvhiiEl3D7DP1gU15X

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\ = "Weasel"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\weasel.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3F4CDED-B1E9-41EE-9CA6-7B4D0DE6CB0A}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3524	4312	regsvr32.exe	88
PID 4312 wrote to memory of 3524	4312	regsvr32.exe	88
PID 4312 wrote to memory of 3524	4312	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\weasel.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\weasel.dll
  2⤵
  - Modifies registry class
  PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads