Overview
overview
6Static
static
3download/M...rm.exe
windows7-x64
6download/M...rm.exe
windows10-2004-x64
6download/X...er.dll
windows7-x64
1download/X...er.dll
windows10-2004-x64
3download/X...rt.exe
windows7-x64
1download/X...rt.exe
windows10-2004-x64
1download/atl71.dll
windows7-x64
1download/atl71.dll
windows10-2004-x64
1download/d...id.dll
windows7-x64
1download/d...id.dll
windows10-2004-x64
1download/d...ne.dll
windows7-x64
1download/d...ne.dll
windows10-2004-x64
1download/minizip.dll
windows7-x64
1download/minizip.dll
windows10-2004-x64
3download/msvcp71.dll
windows7-x64
3download/msvcp71.dll
windows10-2004-x64
3download/msvcr71.dll
windows7-x64
3download/msvcr71.dll
windows10-2004-x64
3download/zlib1.dll
windows7-x64
3download/zlib1.dll
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
download/MiniThunderPlatform.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
download/MiniThunderPlatform.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
download/XLBugHandler.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
download/XLBugHandler.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
download/XLBugReport.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
download/XLBugReport.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
download/atl71.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
download/atl71.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
download/dl_peer_id.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
download/dl_peer_id.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
download/download_engine.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
download/download_engine.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
download/minizip.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
download/minizip.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
download/msvcp71.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
download/msvcp71.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
download/msvcr71.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
download/msvcr71.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
download/zlib1.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
download/zlib1.dll
Resource
win10v2004-20240508-en
General
-
Target
download/dl_peer_id.dll
-
Size
89KB
-
MD5
dba9a19752b52943a0850a7e19ac600a
-
SHA1
3485ac30cd7340eccb0457bca37cf4a6dfda583d
-
SHA256
69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
-
SHA512
a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
SSDEEP
1536:5myH1Ar4zLdIoXJED0ySFzyhSU+kcexDCaDRqxAnNQDB:foEZEDDSFzDkce7RqxAnIB
Malware Config
Signatures
-
Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CLSID\ = "{5D72951E-2B86-41B9-835F-464346928269}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\download\\dl_peer_id.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ProgID\ = "Dl_peer_id.DownloadLibPlugin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ProgID\ = "Dl_peer_id.XlPeerId.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\VersionIndependentProgID\ = "Dl_peer_id.XlPeerId" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\TypeLib\ = "{3E618540-AFE5-4DFC-B440-1A760323133B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CurVer\ = "Dl_peer_id.DownloadLibPlugin.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\VersionIndependentProgID\ = "Dl_peer_id.DownloadLibPlugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\ = "XlPeerId Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CurVer\ = "Dl_peer_id.XlPeerId.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\ = "DownloadLibPlugin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\CLSID\ = "{5D72951E-2B86-41B9-835F-464346928269}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\CLSID\ = "{D76D152E-836B-489B-A333-930A7F22A1D4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\TypeLib\ = "{3E618540-AFE5-4DFC-B440-1A760323133B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\ = "DownloadLibPlugin Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CLSID\ = "{D76D152E-836B-489B-A333-930A7F22A1D4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\ = "XlPeerId Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ = "XlPeerId Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ = "DownloadLibPlugin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\download\\dl_peer_id.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3832 wrote to memory of 3128 3832 regsvr32.exe 82 PID 3832 wrote to memory of 3128 3832 regsvr32.exe 82 PID 3832 wrote to memory of 3128 3832 regsvr32.exe 82