Overview
overview
10Static
static
10tor-browse...14.exe
windows7-x64
7tor-browse...14.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
1$PLUGINSDI...LL.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
1$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
1Browser/Ac...al.dll
windows7-x64
7Browser/Ac...al.dll
windows10-2004-x64
7Browser/To...nt.exe
windows7-x64
1Browser/To...nt.exe
windows10-2004-x64
1Browser/To...rd.exe
windows7-x64
1Browser/To...rd.exe
windows10-2004-x64
1Browser/To...nt.exe
windows7-x64
1Browser/To...nt.exe
windows10-2004-x64
1Browser/To...nt.exe
windows7-x64
1Browser/To...nt.exe
windows10-2004-x64
1Browser/To...or.exe
windows7-x64
3Browser/To...or.exe
windows10-2004-x64
3localizati...ols.js
windows7-x64
3localizati...ols.js
windows10-2004-x64
3localizati...ols.js
windows7-x64
3localizati...ols.js
windows10-2004-x64
3Browser/d3...47.dll
windows10-2004-x64
1Browser/de...efs.js
windows7-x64
3Browser/de...efs.js
windows10-2004-x64
3Browser/firefox.exe
windows7-x64
7Browser/firefox.exe
windows10-2004-x64
7Browser/fo...ar.ps1
windows7-x64
3Browser/fo...ar.ps1
windows10-2004-x64
3Browser/freebl3.dll
windows7-x64
1Analysis
-
max time kernel
292s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 23:08
Behavioral task
behavioral1
Sample
tor-browser-windows-x86_64-portable-13.0.14.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tor-browser-windows-x86_64-portable-13.0.14.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
Browser/AccessibleMarshal.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Browser/AccessibleMarshal.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
Browser/TorBrowser/Tor/PluggableTransports/conjure-client.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Browser/TorBrowser/Tor/PluggableTransports/conjure-client.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
Browser/TorBrowser/Tor/PluggableTransports/lyrebird.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
Browser/TorBrowser/Tor/PluggableTransports/lyrebird.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
Browser/TorBrowser/Tor/PluggableTransports/snowflake-client.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Browser/TorBrowser/Tor/PluggableTransports/snowflake-client.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
Browser/TorBrowser/Tor/PluggableTransports/webtunnel-client.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Browser/TorBrowser/Tor/PluggableTransports/webtunnel-client.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
Browser/TorBrowser/Tor/tor.exe
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
Browser/TorBrowser/Tor/tor.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
localization/hu/devtools/client/perftools.js
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
localization/hu/devtools/client/perftools.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
localization/id/devtools/client/perftools.js
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
localization/id/devtools/client/perftools.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Browser/d3dcompiler_47.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral26
Sample
Browser/defaults/pref/channel-prefs.js
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
Browser/defaults/pref/channel-prefs.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral28
Sample
Browser/firefox.exe
Resource
win7-20240215-en
Behavioral task
behavioral29
Sample
Browser/firefox.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral30
Sample
Browser/fonts/NotoSansNKo-Regular.ps1
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
Browser/fonts/NotoSansNKo-Regular.ps1
Resource
win10v2004-20240419-en
Behavioral task
behavioral32
Sample
Browser/freebl3.dll
Resource
win7-20240221-en
General
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
8KB
-
MD5
59888d7d17f0100e5cffe2aca0b3dfaf
-
SHA1
8563187a53d22f33b90260819624943204924fdc
-
SHA256
f9075791123be825d521525377f340b0f811e55dcec00d0e8d0347f14733f8a3
-
SHA512
d4ca43a00c689fa3204ce859fdd56cf47f92c10ba5cfa93bb987908a072364685b757c85febc11f8b3f869f413b07c6fcc8c3a3c81c9b5de3fba30d35495ff23
-
SSDEEP
96:NtrTcnv5RhqRIwfIis6o6bOl8MNysjgdKXSY7Jemv6ZwMDaH71pj:PHKxqFfzs6o5l2hKXSR6Xj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1256 wrote to memory of 1300 1256 rundll32.exe 28 PID 1256 wrote to memory of 1300 1256 rundll32.exe 28 PID 1256 wrote to memory of 1300 1256 rundll32.exe 28