Overview
overview
10Static
static
10EasyHook.dll
windows11-21h2-x64
1EasyHook32.dll
windows11-21h2-x64
3EasyHook32Svc.exe
windows11-21h2-x64
3EasyHook64.dll
windows11-21h2-x64
1EasyHook64Svc.exe
windows11-21h2-x64
1EasyHookSvc.exe
windows11-21h2-x64
3Ionic.Zip.Reduced.dll
windows11-21h2-x64
1Jint.dll
windows11-21h2-x64
1NAudio.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Nucleus.Gaming.dll
windows11-21h2-x64
1Nucleus.Hook32.dll
windows11-21h2-x64
3Nucleus.Hook64.dll
windows11-21h2-x64
1Nucleus.IJx64.exe
windows11-21h2-x64
1Nucleus.IJx86.exe
windows11-21h2-x64
3Nucleus.SHook32.dll
windows11-21h2-x64
3Nucleus.SHook64.dll
windows11-21h2-x64
1NucleusCoop.exe
windows11-21h2-x64
3ProtoInputHooks32.dll
windows11-21h2-x64
3ProtoInputHooks64.dll
windows11-21h2-x64
1ProtoInputHost.exe
windows11-21h2-x64
3ProtoInputIJ32.exe
windows11-21h2-x64
3ProtoInputIJ64.exe
windows11-21h2-x64
1ProtoInputIJP32.dll
windows11-21h2-x64
3ProtoInputIJP64.dll
windows11-21h2-x64
1ProtoInput...32.dll
windows11-21h2-x64
3ProtoInput...64.dll
windows11-21h2-x64
1ProtoInput...32.dll
windows11-21h2-x64
3ProtoInput...64.dll
windows11-21h2-x64
1SharpDX.Di...ut.dll
windows11-21h2-x64
1SharpDX.XInput.dll
windows11-21h2-x64
1utils/x360..._3.dll
windows11-21h2-x64
3Resubmissions
09-08-2024 06:22
240809-g5c3zs1ejc 10Analysis
-
max time kernel
1396s -
max time network
1160s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-08-2024 06:22
Behavioral task
behavioral1
Sample
EasyHook.dll
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
EasyHook32.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
EasyHook32Svc.exe
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
EasyHook64.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
EasyHook64Svc.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
EasyHookSvc.exe
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Ionic.Zip.Reduced.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Jint.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
NAudio.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Newtonsoft.Json.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Nucleus.Gaming.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Nucleus.Hook32.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
Nucleus.Hook64.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
Nucleus.IJx64.exe
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
Nucleus.IJx86.exe
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
Nucleus.SHook32.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
Nucleus.SHook64.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
NucleusCoop.exe
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
ProtoInputHooks32.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
ProtoInputHooks64.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
ProtoInputHost.exe
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
ProtoInputIJ32.exe
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
ProtoInputIJ64.exe
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
ProtoInputIJP32.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
ProtoInputIJP64.dll
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
ProtoInputLoader32.dll
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
ProtoInputLoader64.dll
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
ProtoInputUtilDynamic32.dll
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
ProtoInputUtilDynamic64.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
SharpDX.DirectInput.dll
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
SharpDX.XInput.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
utils/x360ce/xinput1_3.dll
Resource
win11-20240802-en
General
-
Target
ProtoInputLoader32.dll
-
Size
612KB
-
MD5
75d075096225742ecbf396b80ff0ce5c
-
SHA1
464cf21f1437b3210e44abd8e9a6c03a1c035664
-
SHA256
43dcb63cbe5caa2e5c221ac75a71c41ea3c948066a1e1475415368a6d974d434
-
SHA512
90d3561de36aff9fc84e90b4649143955191a70e856651bcede2bd73ac25c5387257d1beb494859b5030b4496a4a06ceac5c3e5e25bf4a9e44ebdf0c67cdcd06
-
SSDEEP
12288:sTSTaL8vLZ9QlNdNeqo4mYSrJPFCw4WXF2SX:sM1964frNF94UFd
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2528 1556 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1556 1812 rundll32.exe 82 PID 1812 wrote to memory of 1556 1812 rundll32.exe 82 PID 1812 wrote to memory of 1556 1812 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ProtoInputLoader32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ProtoInputLoader32.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 4803⤵
- Program crash
PID:2528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1556 -ip 15561⤵PID:4632