3526c74a22a6a7ff285bddc4a055d22e443bd2d9ceb47aa7bc20240256084787

Submit
Reports

Overview

overview

Static

static

174ac08f7f...83.exe

windows7-x64

21697ff9c9...27.dll

windows7-x64

299baa160c...88.exe

windows7-x64

390f8ea304...a2.exe

windows7-x64

3d26ddb0a9...05.exe

windows7-x64

51308678ff...54.exe

windows7-x64

600db89be8...7f.exe

windows7-x64

6860173ca5...b1.dll

windows7-x64

6fd5bdcc62...34.exe

windows7-x64

87cee50a81...c7.exe

windows7-x64

93564e681c...ca.exe

windows7-x64

9c109b79da...97.exe

windows7-x64

9c8685a98f...7f.exe

windows7-x64

CrypMod.exe

windows7-x64

Fuck.exe

windows7-x64

Generic_Ransom_1.exe

windows7-x64

Genericcc.exe

windows7-x64

Gneeirc2.exe

windows7-x64

MyxaH.exe

windows7-x64

a1e86fc6cf...c2.exe

windows7-x64

add230a2e7...10.exe

windows7-x64

ae3a9c9cf9...b7.exe

windows7-x64

b878926219...be.exe

windows7-x64

c28384feb8...1a.exe

windows7-x64

cryptmod2.exe

windows7-x64

d041a11a04...a7.exe

windows7-x64

db3f0b9d66...0f.exe

windows7-x64

dcb283e040...ea.exe

windows7-x64

e54de5d857...f3.exe

windows7-x64

f14fd49537...19.exe

windows7-x64

f7ee55f157...ed.exe

windows7-x64

genenenrnenr.exe

windows7-x64

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 13:44

Sharing

Copy URL

Twitter E-mail

Static task

static1

aspackv2 upx 13 49 sodinokibi

5 signatures

Behavioral task

behavioral1

Sample

174ac08f7fd9c8486511122f2b8c730018c68d4492bf58840f7dbe5338072883.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral2

Sample

21697ff9c9b2ad4fb91d805cd139175a4ff8fbddf1fdff52c9dd8eee78612b27.dll

Resource

win7-20240221-en

windows7-x64

1 signatures

1800 seconds

Behavioral task

behavioral3

Sample

299baa160cc77a615a22266ea21c1eabc357ade95901e569d82731ba44309f88.exe

Resource

win7-20240221-en

persistence

windows7-x64

8 signatures

1800 seconds

Behavioral task

behavioral4

Sample

390f8ea3044007611ebadad5352708aa3d0df0872b4550100f439a0aad7213a2.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral5

Sample

3d26ddb0a96c825ff98a6b6456bf52dab1a896da2a8690a041524a6c82213a05.exe

Resource

win7-20240221-en

modiloader persistence trojan upx

windows7-x64

6 signatures

1800 seconds

Behavioral task

behavioral6

Sample

51308678ff4559482f32fc2138d4134b412ab75977c19003bd6a7209b3c1cb54.exe

Resource

win7-20240220-en

persistence

windows7-x64

3 signatures

1800 seconds

Behavioral task

behavioral7

Sample

600db89be8dbd50e60c620ea147688cea7d512b1dc545a6b95fe41f0dfeca57f.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral8

Sample

6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1.dll

Resource

win7-20240215-en

windows7-x64

1 signatures

1800 seconds

Behavioral task

behavioral9

Sample

6fd5bdcc625d735f67f0ad4cacd06feb2ae20a2ec7626ff91fbd1848d1173d34.exe

Resource

win7-20240221-en

modiloader persistence trojan upx

windows7-x64

8 signatures

1800 seconds

Behavioral task

behavioral10

Sample

87cee50a81408e14f015d7507a87950e678742ba78015fd65d24f9934d22c9c7.exe

Resource

win7-20240221-en

persistence upx

windows7-x64

13 signatures

1800 seconds

Behavioral task

behavioral11

Sample

93564e681c3b63f14bfb67df98f5461917c447f343770a3a944ab251c4dac5ca.exe

Resource

win7-20240319-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral12

Sample

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Resource

win7-20240221-en

evasion persistence

windows7-x64

6 signatures

1800 seconds

Behavioral task

behavioral13

Sample

9c8685a98f9be3a699ea95314449fd90fbaeac3e587efdfcb0c495621e7b087f.exe

Resource

win7-20240221-en

evasion persistence spyware stealer trojan upx

windows7-x64

26 signatures

1800 seconds

Behavioral task

behavioral14

Sample

CrypMod.exe

Resource

win7-20240215-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

16 signatures

1800 seconds

Behavioral task

behavioral15

Sample

Fuck.exe

Resource

win7-20231129-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

14 signatures

1800 seconds

Behavioral task

behavioral16

Sample

Generic_Ransom_1.exe

Resource

win7-20240220-en

persistence

windows7-x64

14 signatures

1800 seconds

Behavioral task

behavioral17

Sample

Genericcc.exe

Resource

win7-20240221-en

aspackv2 persistence

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral18

Sample

Gneeirc2.exe

Resource

win7-20240221-en

persistence ransomware spyware stealer

windows7-x64

20 signatures

1800 seconds

Behavioral task

behavioral19

Sample

MyxaH.exe

Resource

win7-20240221-en

netwire botnet rat stealer

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral20

Sample

a1e86fc6cfb129a978b7de1f8b773f766640e50874d8989999be2c55c6d022c2.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral21

Sample

add230a2e7aabf2ea909f641894d9febc6673cf23623a00ce3f47bc73ec9b310.exe

Resource

win7-20240221-en

sodinokibi ransomware

windows7-x64

11 signatures

1800 seconds

Behavioral task

behavioral22

Sample

ae3a9c9cf994b6f1967aee6a31f13796e0f59d4c2bd22865e24f2babf2043bb7.exe

Resource

win7-20240221-en

evasion persistence upx

windows7-x64

12 signatures

1800 seconds

Behavioral task

behavioral23

Sample

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

Resource

win7-20231129-en

upx

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral24

Sample

c28384feb8d622682c10e81da44448c226638a7fed9b531ab7a5f652c55b3e1a.exe

Resource

win7-20240220-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral25

Sample

cryptmod2.exe

Resource

win7-20240221-en

gandcrab backdoor ransomware spyware stealer

windows7-x64

16 signatures

1800 seconds

Behavioral task

behavioral26

Sample

d041a11a04bba9142ee44712a53c8e94bccefeefe1d382ac35171518cd6b64a7.exe

Resource

win7-20240221-en

persistence upx

windows7-x64

9 signatures

1800 seconds

Behavioral task

behavioral27

Sample

db3f0b9d66482afc1f2328f7eee8a8cc57ce03e19a4325e50d239203a4d17e0f.exe

Resource

win7-20240221-en

persistence

windows7-x64

5 signatures

1800 seconds

Behavioral task

behavioral28

Sample

dcb283e040d84bf1a86b381bfb0ce6b8dc070b58ba5d3150eed9cb7becf769ea.exe

Resource

win7-20240221-en

windows7-x64

4 signatures

1800 seconds

Behavioral task

behavioral29

Sample

e54de5d857ff16efd72ff0223235826494147444538f725f6977ca892282e7f3.exe

Resource

win7-20240215-en

persistence upx

windows7-x64

7 signatures

1800 seconds

Behavioral task

behavioral30

Sample

f14fd49537695f6e33bd102633b0737a2713df3197e36b7cdb176bc8683f6919.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

1800 seconds

Behavioral task

behavioral31

Sample

f7ee55f1571b1a082a8e61811811009b02e5b0d651bd7c3f8d29ca16ef1e14ed.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral32

Sample

genenenrnenr.exe

Resource

win7-20240221-en

windows7-x64

3 signatures

1800 seconds

Report Analysis Logs

General

Target

6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1.dll
Size

19KB
MD5

1dc214e694aa0bea8649d840581c07b5
SHA1

4d905f6faddbac18fa5a9b9926c4853ccda2a165
SHA256

6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1
SHA512

035620842a278ed03cae8d9f1dd749eee54f0aa00357b2d5df5e91f91c04cc7184d2fd3b8e0ba60bc6216097ef5689e5e9cd856bd09a0c60d105a4c091823543
SSDEEP

384:FsAHwKr2eLG2ydifQuvREasXLmQLFRkoC/kDKqdojB8/c:FsxKr2eLG2ydifQuvREawLnL7C/qKty

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 2192	1920	regsvr32.exe	regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6860173ca54b7e763cc667ac54435f1a18a821e09453b9e41556b6c2e9323eb1.dll
2⤵
PID:2192

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads