809eb0570ba5abcd4ab012b354b4e1f0311eff595b1988ab0735bf1ab846e632

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AptRegIns.dll
Size

417KB
MD5

2b5ecab2001124dd954e78116dafa0c8
SHA1

bac5e989d52cde9482cc9343dd4a1223f39b644b
SHA256

97fec26ee0b538165fdf9de49149cf4fb726deb5e11dfb2efb35ec46077e33c3
SHA512

7c02122a1d854a05a2a6a2dbb259953d9c58483947a902911f440fd5ce566519263b680cd1dd89ccc45d512fadfa399b516d779b5d406fa92de078820daae69b
SSDEEP

12288:xRXLNgelinW9nSSEL3FLFs74HFoYZ+DcThf8RbmNsHrV2:5UHFLFFFLZqcBwqNn

Score

8^/10

evasion trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1776	rundll32.exe
6	1776	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28
PID 2740 wrote to memory of 1776	2740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AptRegIns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AptRegIns.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Checks whether UAC is enabled
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-0-0x0000000002B30000-0x0000000002CA4000-memory.dmp

Filesize
1.5MB

Download