Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 07:01
Behavioral task
behavioral1
Sample
67b2584d6884366079f1c82a46e6b110N.dll
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
67b2584d6884366079f1c82a46e6b110N.dll
-
Size
76KB
-
MD5
67b2584d6884366079f1c82a46e6b110
-
SHA1
65a045cf44a3ad5e6cf43a27dea8eac05baa6afb
-
SHA256
c3255f741ca01d83747baed2b5adec49953ac115c9dd465d0ed7e4f3cfe46f30
-
SHA512
fc69a2c632f7d63312a7b8c6847df314ac51f61a41cfad878d321b676d1ca1ed524048a7c57fe95a60ec7f8473c10cadfdd0abe88e511b0dcca8f46b210cb732
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZfMzQs:c8y93KQjy7G55riF1cMo03N3s
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3000-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3000-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3000 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3000 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30 PID 2708 wrote to memory of 3000 2708 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67b2584d6884366079f1c82a46e6b110N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67b2584d6884366079f1c82a46e6b110N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-