Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 10:55
Static task
static1
Behavioral task
behavioral1
Sample
shed.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
shed.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
d4xd.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
d4xd.dll
Resource
win10v2004-20240802-en
General
-
Target
d4xd.dll
-
Size
10KB
-
MD5
cc531db3ae7d662a2054f787c038762d
-
SHA1
5f87a3836db1886d07a0d480cb7b72d89672d36a
-
SHA256
9ca23ee06a0d89ba6a9b18bce1e3a7d94bf987df10234d2890d5e860d8a2790a
-
SHA512
e01ddaadf0efb4f4ec556e9882d02a51666a5cef118ec617f42c75bf80abb8566a6393fd6899fc76c9537eb66ef2c081fb5eec13f13bdc2a2ee74bd1b34d5632
-
SSDEEP
192:w1fC8d6aoXnsYIx694C+SX/FOGXyCp2X+7FTpxRkSZDm:SC+6tyQj+SXtHFpLFTpxb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4xd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4xd.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2584
-