Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
Resource
win10v2004-20240802-en
General
-
Target
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
-
Size
446KB
-
MD5
c5642443fd69d4eb4411e6992c3490c5
-
SHA1
b24c7528aa3d6254167636ee656b8396a7fba252
-
SHA256
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64
-
SHA512
a3062585e8a23f897a9c02feb7b4144b6d69fccce3df6824085fba9c08a3c0c7ca1698f85d674c9ef31848838812679c245b303f9b3a55553d053d8cf6d0201c
-
SSDEEP
12288:PNNnu26gZ9Aymc3t2R7wv/kbrB9qfAwV6sEARJj04zoS:P3VPAE3t4wv/k8pEQA
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2644 set thread context of 2812 2644 rundll32.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2644 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2644 rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2260 wrote to memory of 2644 2260 rundll32.exe 30 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31 PID 2644 wrote to memory of 2812 2644 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
PID:2812
-
-