Overview
overview
10Static
static
3SearchFilter.exe
windows10-2004-x64
10d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows10-2004-x64
3libEGL.dll
windows10-2004-x64
3libGLESv2.dll
windows10-2004-x64
3locales/af.ps1
windows10-2004-x64
3locales/uk.ps1
windows10-2004-x64
3resources/...RBx.js
windows10-2004-x64
3vk_swiftshader.dll
windows10-2004-x64
3vulkan-1.dll
windows10-2004-x64
3Analysis
-
max time kernel
417s -
max time network
454s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2024 00:32
Static task
static1
Behavioral task
behavioral1
Sample
SearchFilter.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
locales/af.ps1
Resource
win10v2004-20240729-en
Behavioral task
behavioral7
Sample
locales/uk.ps1
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
resources/NmnfgaXt2luNfmDz65AVkRBx.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
vulkan-1.dll
Resource
win10v2004-20240704-en
General
-
Target
vk_swiftshader.dll
-
Size
4.5MB
-
MD5
65a5705d95a0820740b3396851ff1751
-
SHA1
a692a80bafc41ba1b29ef19890f8465b3fb20dcb
-
SHA256
4c4b935cbb320033f504a89b1eb0a4bcb176bbd46a5981153cb1f54deb146a1c
-
SHA512
0c5df23b96eaf952c4a498ff6d854df2b62e7631b16c2855ed37ddbadffba3dd52e7450f2e06cf094bec2e0d70d14c87a652150766d90ec8662e03123df5942d
-
SSDEEP
98304:x2GmsucG1vUTM3SFhCrHglx7LQDCwchuW6ugI:cuuF4XhCGLQDCaI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2768 1544 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4772 wrote to memory of 1544 4772 rundll32.exe 86 PID 4772 wrote to memory of 1544 4772 rundll32.exe 86 PID 4772 wrote to memory of 1544 4772 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 6003⤵
- Program crash
PID:2768
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 15441⤵PID:1920