c9b39bed368f989fdc89659c79176ad3bde3b6e25239c5647aa16f7dee5d1f55

General

Target
Memlib.dll
Size 11.6MB
Sample260730-bmpfeazvdw
SHA256 c9b39bed368f989fdc89659c79176ad3bde3b6e25239c5647aa16f7dee5d1f55
MD5 ac3c802143ce24db4639ae920be5278e
SHA1 8ca26dccf4edd38b9d4339f82a82a59c0aa25183
SHA512 be66d66e9d71ee9dded7179d523d702483fe69e54f2e71ca3a73c7a0aae395d5323d482db3d7487e75bb4013a5c24e0f3c5eaafad9c05a8789d5078370c5fc74
SSDEEP 196608:8/jEUoJMap13yGysZmKtGf2KkECP/lOgUZGCFQ6Mh8RB63BX5cnZ5TOE+415I7v:CEUo5AuZRCzADUvQ6e8RBWBXOnLOEj1
TLSH
T195C6333326B02244D8E5C939CF33FC7532F3026B968169FD859B2AC576965A49B13F83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4156	cmd.exe
2968	cmd.exe
3244	cmd.exe
3800	cmd.exe
5888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
716	reg.exe
2740	reg.exe
632	reg.exe
2808	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1040	4960	rundll32.exe	89
PID 1040 wrote to memory of 4156	1040	rundll32.exe	90
PID 4156 wrote to memory of 716	4156	cmd.exe	92
PID 1040 wrote to memory of 2968	1040	rundll32.exe	93
PID 2968 wrote to memory of 2740	2968	cmd.exe	95
PID 1040 wrote to memory of 3244	1040	rundll32.exe	96
PID 3244 wrote to memory of 632	3244	cmd.exe	98
PID 1040 wrote to memory of 3800	1040	rundll32.exe	99
PID 3800 wrote to memory of 2808	3800	cmd.exe	101
PID 1040 wrote to memory of 5888	1040	rundll32.exe	102

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Memlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Memlib.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe add HKCU\Software\Tencent\MobileGamePC /v VMDeviceManufacturer /t REG_SZ /d samsung /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add HKCU\Software\Tencent\MobileGamePC /v VMDeviceManufacturer /t REG_SZ /d samsung /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe add HKCU\Software\Tencent\MobileGamePC /v VMDeviceModel /t REG_SZ /d SM-X910 /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add HKCU\Software\Tencent\MobileGamePC /v VMDeviceModel /t REG_SZ /d SM-X910 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe add HKCU\Software\Tencent\MobileGamePC /v AdbDisable /t REG_DWORD /d 0 /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add HKCU\Software\Tencent\MobileGamePC /v AdbDisable /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg.exe add HKCU\Software\Tencent\MobileGamePC /v RootEnabled /t REG_DWORD /d 0 /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add HKCU\Software\Tencent\MobileGamePC /v RootEnabled /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5888