Overview
overview
7Static
static
3Multi-Acco...er.zip
windows7-x64
1Multi-Acco...er.zip
windows10-2004-x64
1MapiProxy.dll
windows7-x64
5MapiProxy.dll
windows10-2004-x64
5MapiProxy_InUse.dll
windows7-x64
5MapiProxy_InUse.dll
windows10-2004-x64
5Multi-Checker.exe
windows7-x64
7Multi-Checker.exe
windows10-2004-x64
7NiceRAT.pyc
windows7-x64
3NiceRAT.pyc
windows10-2004-x64
3libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1libotr.dll
windows7-x64
1libotr.dll
windows10-2004-x64
1libssp-0.dll
windows7-x64
1libssp-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 19:27
Behavioral task
behavioral1
Sample
Multi-Account_checker.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Multi-Account_checker.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MapiProxy.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
MapiProxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
MapiProxy_InUse.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
MapiProxy_InUse.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Multi-Checker.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Multi-Checker.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
NiceRAT.pyc
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
NiceRAT.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
libotr.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
libotr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
libssp-0.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
libssp-0.dll
Resource
win10v2004-20240226-en
General
-
Target
MapiProxy_InUse.dll
-
Size
24KB
-
MD5
109de960ac9ec36e2c14fe499b74e6d9
-
SHA1
4f7add83946aa3d2a0f1b2b3b879a03ece4606c7
-
SHA256
32c8b9c53c7fa6bec5ddf24ae83f4874cbbafb572b469270bfc0e9f4adeef4f8
-
SHA512
348b682d54c5237721235de04c24cd62afb4f46412e3ff1467a5e9481435b3d562a9541e972ee805d058f1c40b5b9c9d6c84f827e5a76f321915a16bd28b1aa3
-
SSDEEP
384:g6JE2If4VrpPBlvDG/t8E9VF0NyxAM+oJwEErbG:g6JJIf4Vn5DGyELAMxtCG
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 13 IoCs
Processes:
regsvr32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\ = "nsIMapi" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\ProxyStubClsid32\ = "{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MapiProxy_InUse.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDCD38E-8861-11D5-A3DD-00B0D0F3BAA7}\NumMethods\ = "16" regsvr32.exe