Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
Resource
win10v2004-20240802-en
General
-
Target
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll
-
Size
446KB
-
MD5
c5642443fd69d4eb4411e6992c3490c5
-
SHA1
b24c7528aa3d6254167636ee656b8396a7fba252
-
SHA256
70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64
-
SHA512
a3062585e8a23f897a9c02feb7b4144b6d69fccce3df6824085fba9c08a3c0c7ca1698f85d674c9ef31848838812679c245b303f9b3a55553d053d8cf6d0201c
-
SSDEEP
12288:PNNnu26gZ9Aymc3t2R7wv/kbrB9qfAwV6sEARJj04zoS:P3VPAE3t4wv/k8pEQA
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3280 rundll32.exe 3280 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3280 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2604 wrote to memory of 3280 2604 rundll32.exe 84 PID 2604 wrote to memory of 3280 2604 rundll32.exe 84 PID 2604 wrote to memory of 3280 2604 rundll32.exe 84 PID 3280 wrote to memory of 2212 3280 rundll32.exe 85 PID 3280 wrote to memory of 2212 3280 rundll32.exe 85 PID 3280 wrote to memory of 2212 3280 rundll32.exe 85 PID 3280 wrote to memory of 824 3280 rundll32.exe 86 PID 3280 wrote to memory of 824 3280 rundll32.exe 86 PID 3280 wrote to memory of 824 3280 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70bc96352f5402664f252c6b9167829e2a66a6aa96caa0f32768e57006d77f64.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:2212
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:824
-
-