Analysis
-
max time kernel
110s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 07:01
Behavioral task
behavioral1
Sample
67b2584d6884366079f1c82a46e6b110N.dll
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
67b2584d6884366079f1c82a46e6b110N.dll
-
Size
76KB
-
MD5
67b2584d6884366079f1c82a46e6b110
-
SHA1
65a045cf44a3ad5e6cf43a27dea8eac05baa6afb
-
SHA256
c3255f741ca01d83747baed2b5adec49953ac115c9dd465d0ed7e4f3cfe46f30
-
SHA512
fc69a2c632f7d63312a7b8c6847df314ac51f61a41cfad878d321b676d1ca1ed524048a7c57fe95a60ec7f8473c10cadfdd0abe88e511b0dcca8f46b210cb732
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZfMzQs:c8y93KQjy7G55riF1cMo03N3s
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4940-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4940-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4940 rundll32.exe 4940 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4940 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2380 wrote to memory of 4940 2380 rundll32.exe 84 PID 2380 wrote to memory of 4940 2380 rundll32.exe 84 PID 2380 wrote to memory of 4940 2380 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67b2584d6884366079f1c82a46e6b110N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67b2584d6884366079f1c82a46e6b110N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-