Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 21:49
Static task
static1
Behavioral task
behavioral1
Sample
5bfc2c9fa92025c8353e887c64796110N.dll
Resource
win7-20240704-en
General
-
Target
5bfc2c9fa92025c8353e887c64796110N.dll
-
Size
564KB
-
MD5
5bfc2c9fa92025c8353e887c64796110
-
SHA1
c9406a3387b30c15e1997746832a1e6a3b396db6
-
SHA256
ecfacdf9186ee26b063dfa26161a07643838d9d89a457b19aaf8e84494a2be09
-
SHA512
a1ed9651c0b23bb6383b38237bbcaf3ddbd91800b773a1ba2977ab3983e91d752478360171a58728fd23e5670d978a302c35437cc35dd46436948a9c2631aea4
-
SSDEEP
12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVv:teh0PpS6NxNnwYeOHXAhWTv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2660 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 3068 rundll32.exe 3068 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2660-13-0x0000000002920000-0x00000000039AE000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2920 3068 WerFault.exe rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exerundll32mgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3068 3044 rundll32.exe rundll32.exe PID 3068 wrote to memory of 2660 3068 rundll32.exe rundll32mgr.exe PID 3068 wrote to memory of 2660 3068 rundll32.exe rundll32mgr.exe PID 3068 wrote to memory of 2660 3068 rundll32.exe rundll32mgr.exe PID 3068 wrote to memory of 2660 3068 rundll32.exe rundll32mgr.exe PID 3068 wrote to memory of 2920 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2920 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2920 3068 rundll32.exe WerFault.exe PID 3068 wrote to memory of 2920 3068 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfc2c9fa92025c8353e887c64796110N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bfc2c9fa92025c8353e887c64796110N.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2243⤵
- Program crash
PID:2920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94