6d1816a16faf2f4c08172633a3849a9d8688ae6519f87a8c8cbffd307cfdb90d

Analysis

max time kernel
92s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft DirectX/dsetup32.dll
Size

1.5MB
MD5

a5412a144f63d639b47fcc1ba68cb029
SHA1

81bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA256

8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
SHA512

2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
SSDEEP

24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\DXError.log	rundll32.exe
File opened for modification	C:\Windows\Logs\DirectX.log	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 3332	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 3332	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 3332	2228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dsetup32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Microsoft DirectX\dsetup32.dll",#1
2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Logs\DXError.log

Filesize
186B

MD5
191281948e7517c5ec3ece7a8f0f7231

SHA1
72ae1b56afb4bc5c841dc7b408d015c0a81c27eb

SHA256
7d481ac4fe781bcf628f28523e1e6e5077d7599df2ed787277f2b8fa0d0e171f

SHA512
6177cf6561d4badb222d3df98bbd26d1cbd0aa016e849bfdb8ad304d71d8d820a1e9f78eb20403446f4971dec585029113875ec3904066df58725a273c432a01

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
679B

MD5
a602764941c78b4a695991a465fea414

SHA1
5a4d9d96388db1e52ac59da54f2f58103a03c7ff

SHA256
7684141b6e07a497f489a9bfaf58a3050e0e0004609f1ee9cd10a1efc8f5219a

SHA512
992fd4eef18a68294923ad4d87beb5238f612c3ac722c208df7ef7d2349507f5a0141b1639a12199d024d785d0af67e4001b8864b5b556866f7aef7f6e1cc006

Download Submit