Overview
overview
10Static
static
3programm/A...re.dll
windows7-x64
3programm/A...re.dll
windows10-2004-x64
3programm/HTCTL32.dll
windows7-x64
3programm/HTCTL32.dll
windows10-2004-x64
3programm/PCICHEK.dll
windows7-x64
3programm/PCICHEK.dll
windows10-2004-x64
3programm/PCICL32.dll
windows7-x64
3programm/PCICL32.dll
windows10-2004-x64
3programm/TCCTL32.dll
windows7-x64
3programm/TCCTL32.dll
windows10-2004-x64
3programm/msvcr100.dll
windows7-x64
3programm/msvcr100.dll
windows10-2004-x64
3programm/pcicapi.dll
windows7-x64
3programm/pcicapi.dll
windows10-2004-x64
3programm/r...ub.exe
windows7-x64
3programm/r...ub.exe
windows10-2004-x64
3programm/soft.exe
windows7-x64
10programm/soft.exe
windows10-2004-x64
10Analysis
-
max time kernel
94s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
programm/AudioCapture.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
programm/AudioCapture.dll
Resource
win10v2004-20240729-en
Behavioral task
behavioral3
Sample
programm/HTCTL32.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
programm/HTCTL32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
programm/PCICHEK.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
programm/PCICHEK.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
programm/PCICL32.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
programm/PCICL32.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
programm/TCCTL32.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
programm/TCCTL32.dll
Resource
win10v2004-20240729-en
Behavioral task
behavioral11
Sample
programm/msvcr100.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
programm/msvcr100.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
programm/pcicapi.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
programm/pcicapi.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
programm/remcmdstub.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
programm/remcmdstub.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
programm/soft.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
programm/soft.exe
Resource
win10v2004-20240709-en
General
-
Target
programm/PCICL32.dll
-
Size
3.5MB
-
MD5
ad51946b1659ed61b76ff4e599e36683
-
SHA1
dfe2439424886e8acf9fa3ffde6caaf7bfdd583e
-
SHA256
07a191254362664b3993479a277199f7ea5ee723b6c25803914eedb50250acf4
-
SHA512
6c30e7793f69508f6d9aa6edcec6930ba361628ef597e32c218e15d80586f5a86d89fcbee63a35eab7b1e0ae26277512f4c1a03df7912f9b7ff9a9a858cf3962
-
SSDEEP
49152:xOHDe5Yr6tYA4S+DjdwfwBTNZaZQclSpmTIH:xOHDe5YrvS+tBQSEm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4208 wrote to memory of 1952 4208 rundll32.exe 84 PID 4208 wrote to memory of 1952 4208 rundll32.exe 84 PID 4208 wrote to memory of 1952 4208 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\programm\PCICL32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\programm\PCICL32.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1952
-