b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe
Size

10.3MB
MD5

be9dea2a24540a341526340a7bde194a
SHA1

122a513ec66a4d3fe66b67bca5411e86632da56a
SHA256

b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01
SHA512

05c4591f76e34d254bb1516b647cfe1ece16b1c64b2ca06cd044a5d0b9b99b60295cbad62f2a03e8743739afce10717916407a09ad7d39b5ea8d0994ba187114
SSDEEP

98304:5UHDw3hcqTr49wd20JBAUZLpp5L69txjd7ZUv49OtInxl1UJhvmMKt6Vv8PXproB:Mw3aeJVdpl+Zd7ZbOOm7mrtXPXprueJU

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

RegAsm.exeRegAsm.exe

pid process

2732 RegAsm.exe
2732 RegAsm.exe
2436 RegAsm.exe
2436 RegAsm.exe

pid	process
2732	RegAsm.exe
2732	RegAsm.exe
2436	RegAsm.exe
2436	RegAsm.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2192-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2192-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Modifies registry class 34 IoCs

Processes:

RegAsm.exeRegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\Implemented Categories	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand\ = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\ThreadingModel = "Both"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\Assembly = "Get, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\ = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\ = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\ThreadingModel = "Both"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\Class = "Get.Rand"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\RuntimeVersion = "v4.0.30319"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/SeQID.dll"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\Class = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand\CLSID\ = "{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand\ = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\Assembly = "Get, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\Class = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand\CLSID\ = "{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\Assembly = "Get, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\ProgId\ = "Get.Rand"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\ = "mscoree.dll"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\ProgId	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\ProgId\ = "Get.Rand"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Get.Rand\CLSID	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\ = "mscoree.dll"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\RuntimeVersion = "v4.0.30319"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\Class = "Get.Rand"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\Assembly = "Get, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	RegAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/SeQID.dll"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEF633B8-9402-3FA9-B4E3-FB1DE789DA6D}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	RegAsm.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe

pid	process
2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe
2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe
2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe

description	pid	process	target process
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2732	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe
PID 2192 wrote to memory of 2436	2192	b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe
"C:\Users\Admin\AppData\Local\Temp\b841ad0f78c68d3949355cb3870c2df86499129d73245eccfd39975cc19c9d01.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\SeQID.dll
2⤵
- Loads dropped DLL
- Modifies registry class
PID:2732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\SeQID.dll /codebase
2⤵
- Loads dropped DLL
- Modifies registry class
PID:2436

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SeQID.dll
Filesize
7KB

MD5
7f928bbfeadc9c8ab63097ab424aa60b

SHA1
99375d12aba274a404f3925f4b243114d972ff5b

SHA256
aa950d3dd2e1b13affa176bf55f0fee05e9903547ddace19bb75d36cca923b57

SHA512
47319daeaffdca9163823a6bf90ae0a1ead12a3d2e474337bbd674dd58c417e9d3e26431a622858205d247684eb8c01185c30630e22bfe4ee6e38623e2c60f1e

Download Submit
memory/2192-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2192-0-0x00000000004A2000-0x00000000004A3000-memory.dmp

Filesize
4KB

Download
memory/2732-49-0x00000000009D0000-0x00000000009E2000-memory.dmp

Filesize
72KB

Download
memory/2732-55-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads