Overview
overview
10Static
static
10HDDRegener...MM.dll
windows7-x64
3HDDRegener...MM.dll
windows10-2004-x64
3HDDRegener...MT.dll
windows7-x64
3HDDRegener...MT.dll
windows10-2004-x64
3HDDRegener...or.exe
windows7-x64
3HDDRegener...or.exe
windows10-2004-x64
3HDDRegener...se.exe
windows7-x64
3HDDRegener...se.exe
windows10-2004-x64
3HDDRegener...ll.dll
windows7-x64
3HDDRegener...ll.dll
windows10-2004-x64
3HDDRegener...65.dll
windows7-x64
3HDDRegener...65.dll
windows10-2004-x64
3HDDRegener...eg.exe
windows7-x64
7HDDRegener...eg.exe
windows10-2004-x64
7HDDRegener...��.exe
windows7-x64
4HDDRegener...��.exe
windows10-2004-x64
4Analysis
-
max time kernel
71s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 04:34
Behavioral task
behavioral1
Sample
HDDRegenerator2013/BORLNDMM.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
HDDRegenerator2013/BORLNDMM.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
HDDRegenerator2013/CC3280MT.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
HDDRegenerator2013/CC3280MT.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
HDDRegenerator2013/HDD Regenerator.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
HDDRegenerator2013/HDD Regenerator.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
HDDRegenerator2013/Purchase.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
HDDRegenerator2013/Purchase.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
HDDRegenerator2013/WindowsShell.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
HDDRegenerator2013/WindowsShell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
HDDRegenerator2013/eSellerateControl365.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
HDDRegenerator2013/eSellerateControl365.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
HDDRegenerator2013/hddreg.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
HDDRegenerator2013/hddreg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
HDDRegenerator2013/硬盘再生器.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
HDDRegenerator2013/硬盘再生器.exe
Resource
win10v2004-20241007-en
General
-
Target
HDDRegenerator2013/BORLNDMM.dll
-
Size
29KB
-
MD5
f585e57ef674643e2aefbda6debe2854
-
SHA1
abf65042408088ab4f36a2d2834004ff7979285e
-
SHA256
234114dfdeac2f382cd50611b1f449395a6ce83ccb3d028ef64263c465df7b6a
-
SHA512
eeba42c0f6e2d2d61c54a539317285aac8aa6cafc1657a7bf4ddd826e5dabd7b8410eaaa52e0b45871014b7410b53a211c37b51bfc38d159e291ae5521b18a29
-
SSDEEP
768:J2D8hqY8/ija+1I5GDLsmgWHEEyJRmu/ija+1InLZl0PNvOLRO:J2D8s8PJ7yTDZl0FvOLRO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2364 1128 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1740 wrote to memory of 1128 1740 rundll32.exe 30 PID 1128 wrote to memory of 2364 1128 rundll32.exe 31 PID 1128 wrote to memory of 2364 1128 rundll32.exe 31 PID 1128 wrote to memory of 2364 1128 rundll32.exe 31 PID 1128 wrote to memory of 2364 1128 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HDDRegenerator2013\BORLNDMM.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HDDRegenerator2013\BORLNDMM.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 2283⤵
- Program crash
PID:2364
-
-