59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da

General

Target

59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll
Size

257KB
MD5

d1dc9cd84b9ba5e462e9f76513928d42
SHA1

0f2df217f5970048692bc2365a07c7cd52c55c17
SHA256

59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da
SHA512

599051b030f54a589fff0b0977f69cd5adbadb7393b45db831debdd41cbf85252a1019041bad3fae48f981a71ff9b2118343ab01e69c90963e4ea53c5c74503e
SSDEEP

6144:mqhaoZZRrvPJtomDFQv8ldJ6EkJOcT4sOXGOrrlae+q92:m8ftLromBQv+dMeerOrrlPJ92

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\.obs32\{4F4D4544-4DEFB15F-B421206A-EB91457D}.Debug	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Obsidium\{4F4D4544-4DEFB15F-B421206A-EB91457D}.Environment	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\.obs32\{4F4D4544-4DEFB15F-B421206A-EB91457D}.Debug	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Obsidium\{4F4D4544-4DEFB15F-B421206A-EB91457D}.Environment	rundll32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 2240 wrote to memory of 2288	2240	rundll32.exe	28
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 3024 wrote to memory of 2952	3024	rundll32.exe	30
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31
PID 2952 wrote to memory of 2616	2952	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll,#1
  2⤵
  PID:2288

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\59ac1b76180d491293be58b14b7aee0070e232202445bb9eea676c8fa3c381da.dll,#1
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-4-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2288-3-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-10-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-9-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-8-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-7-0x0000000010001000-0x000000001000B000-memory.dmp

Filesize
40KB

Download
memory/2288-6-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/2288-11-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-5-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2288-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-23-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-25-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-19-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-20-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-21-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2616-22-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2616-24-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-12-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-16-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-17-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-18-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-15-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2952-13-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2952-14-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads