977aed08cd11ee877fa275f911ac213b3db4dba8bbb60f895461b1fc9757666a

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tokio.dll
Size

461KB
MD5

f02a72a077b8ff624053bc6c7b0782b6
SHA1

11828e2b7780e808f2b1a07350c0c149b19005be
SHA256

3753f687a7dddbc4e0d2571971634ad90e9dac5909e559bbcbdd67e20b3808d9
SHA512

a7973c4d2b44554ccdb6d5cf4ac771b40386e4f8e6c0ffc1c3b3981f4bc7a944c4447503d14850f6421c409bca916db9ecb3e123bb07e23d2d3da5f2ea7c0c24
SSDEEP

12288:xmZZ3jCZwus8D0UC3mlCVyU2f2sPuYnsbISu7h:Y2Z6UYmluumYnsM1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tokio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tokio.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000000180000-0x0000000000200000-memory.dmp

Filesize
512KB

Download
memory/2152-1-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download