Overview
overview
8Static
static
1npcap-1.72.exe
windows7-x64
8npcap-1.72.exe
windows10-2004-x64
8$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ll.exe
windows7-x64
4$PLUGINSDI...ll.exe
windows10-2004-x64
4$PLUGINSDI...re.dll
windows7-x64
3$PLUGINSDI...re.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3NPFInstall.exe
windows7-x64
4NPFInstall.exe
windows10-2004-x64
4x64/NPFInstall.exe
windows7-x64
4x64/NPFInstall.exe
windows10-2004-x64
4Analysis
-
max time kernel
97s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
npcap-1.72.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
npcap-1.72.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NPFInstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NPFInstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SysRestore.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SysRestore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
NPFInstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
NPFInstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
x64/NPFInstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
x64/NPFInstall.exe
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
19KB
-
MD5
f020a8d9ede1fb2af3651ad6e0ac9cb1
-
SHA1
341f9345d669432b2a51d107cbd101e8b82e37b1
-
SHA256
7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0
-
SHA512
408fa5a797d3ff4b917bb4107771687004ba507a33cb5944b1cc3155e0372cb3e04a147f73852b9134f138ff709af3b0fb493cd8fa816c59e9f3d9b5649c68c4
-
SSDEEP
384:u8+Qlt70Fj/lQRY/9VjjgLmqZmZsHLAMThHdjnG:uSqFjm6YLP17ThHdC
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1876 3380 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5084 wrote to memory of 3380 5084 rundll32.exe 83 PID 5084 wrote to memory of 3380 5084 rundll32.exe 83 PID 5084 wrote to memory of 3380 5084 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 6123⤵
- Program crash
PID:1876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3380 -ip 33801⤵PID:1856