Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 03:11
General
- Target e09f5d7e4ff21c0d03748800be04921b.dll
- Size 363KB
- Sample240327-dpz12abd66
- SHA256 b7494949a2cd40fab0f3aabc1521d56e3e60f3213a91d49042b0b711d946b322
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Modifies registry class 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e09f5d7e4ff21c0d03748800be04921b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e09f5d7e4ff21c0d03748800be04921b.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4308-0-0x0000000010000000-0x0000000010072000-memory.dmp
memory/4308-1-0x0000000002BF0000-0x0000000002C4A000-memory.dmp
memory/4308-2-0x0000000003C70000-0x0000000003C72000-memory.dmp
memory/4308-3-0x00000000011C0000-0x00000000011C1000-memory.dmp
memory/4308-4-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/4308-5-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/4308-7-0x0000000003CD0000-0x0000000003CD1000-memory.dmp
memory/4308-6-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/4308-9-0x0000000003CE0000-0x0000000003CE1000-memory.dmp
memory/4308-8-0x0000000003CC0000-0x0000000003CC1000-memory.dmp
memory/4308-10-0x0000000003D00000-0x0000000003D01000-memory.dmp
memory/4308-11-0x0000000003D00000-0x0000000003D01000-memory.dmp