Analysis
- max time kernel
146s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20240730-en - resource tags
- submitted
02/08/2024, 14:37
General
- Target UltimMC/libLauncher_iconfix.dll
- Size 127KB
- Sample240802-rzb9lsxgrm
- SHA256 6940e02dd5c8b32c5782f3eb22ce39835eebf3ded1a39e0661385dc11e79cd15
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_iconfix.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\libLauncher_iconfix.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 6363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4904 -ip 49041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4904-0-0x0000000002A30000-0x0000000002F5F000-memory.dmp
memory/4904-5-0x0000000070940000-0x000000007095C000-memory.dmp
memory/4904-4-0x0000000002A30000-0x0000000002F5F000-memory.dmp
memory/4904-6-0x0000000002A31000-0x0000000002CD9000-memory.dmp
memory/4904-7-0x0000000002A30000-0x0000000002F5F000-memory.dmp
memory/4904-10-0x0000000068AC0000-0x0000000068ACC000-memory.dmp
memory/4904-9-0x000000006E940000-0x000000006E964000-memory.dmp
memory/4904-8-0x0000000070940000-0x000000007095C000-memory.dmp
memory/4904-11-0x000000006FC40000-0x000000006FD41000-memory.dmp
memory/4904-13-0x0000000061940000-0x0000000061EB5000-memory.dmp
memory/4904-12-0x0000000064940000-0x0000000064954000-memory.dmp