44071fbc6433eaf4281412fbc0b395f6e5cc879c746ee0a904ea6a82a9e8509a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MCForge_.dll
Size

851KB
MD5

0a56a6b703130e67e01e19c2ae096fc3
SHA1

10c7a70110033decabcca1066426dfbc753f2637
SHA256

257b453975cee9f8376336f4bc74ecb21258a207e8d81bd11aec92d235b9105c
SHA512

d662b705df1d04ab3cf437b2f206bed99986a7659eda90d893a7c65a0ad0522a2c06187f7d736ff7fcaed91eb9d122c47509bb06a0637da8bdd1ccf99a9a92a6
SSDEEP

12288:+aJi8CoJxdtDu55c151xpWXDegO9vNsMO9:+C1o58iXDe9Fsj9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2548	2608	rundll32.exe	86
PID 2608 wrote to memory of 2548	2608	rundll32.exe	86
PID 2608 wrote to memory of 2548	2608	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCForge_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCForge_.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads