Overview
overview
3Static
static
3pictxt-v4....vp.dll
windows7-x64
3pictxt-v4....vp.dll
windows10-2004-x64
3pictxt-v4....on.dll
windows7-x64
3pictxt-v4....on.dll
windows10-2004-x64
3pictxt-v4....om.dll
windows7-x64
3pictxt-v4....om.dll
windows10-2004-x64
3pictxt-v4....el.dll
windows7-x64
3pictxt-v4....el.dll
windows10-2004-x64
3pictxt-v4....xt.chm
windows7-x64
1pictxt-v4....xt.chm
windows10-2004-x64
1pictxt-v4....xt.exe
windows7-x64
3pictxt-v4....xt.exe
windows10-2004-x64
3pictxt-v4....d.html
windows7-x64
3pictxt-v4....d.html
windows10-2004-x64
3pictxt-v4....nd.htm
windows7-x64
3pictxt-v4....nd.htm
windows10-2004-x64
3pictxt-v4....��.url
windows7-x64
1pictxt-v4....��.url
windows10-2004-x64
1Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 17:53
Static task
static1
Behavioral task
behavioral1
Sample
pictxt-v4.1/dll/Advp.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
pictxt-v4.1/dll/Advp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
pictxt-v4.1/dll/Common.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
pictxt-v4.1/dll/Common.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
pictxt-v4.1/dll/RegCom.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
pictxt-v4.1/dll/RegCom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
pictxt-v4.1/dll/SelectPanel.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
pictxt-v4.1/dll/SelectPanel.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
pictxt-v4.1/help/pictxt.chm
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
pictxt-v4.1/help/pictxt.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
pictxt-v4.1/pictxt.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
pictxt-v4.1/pictxt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
pictxt-v4.1/support/add.html
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
pictxt-v4.1/support/add.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
pictxt-v4.1/temp/send.htm
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
pictxt-v4.1/temp/send.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
pictxt-v4.1/新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
pictxt-v4.1/新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
pictxt-v4.1/dll/RegCom.dll
-
Size
92KB
-
MD5
2b7b4beb00b141aa7d68e9358ef4bd0c
-
SHA1
dae6fae835cdabb1e71c21383c628683ecc4d6ed
-
SHA256
4887a4fac0ab0c5e3d3b2fa869fca817d20f8675e1b517a7de00e8446618c2f1
-
SHA512
904c5d8b0be60bb227031a66b5e0da6fe7b01983424a64e0027fa0a7c340e2244ce26cde8f13ddc2dfeea9cd88986625c3900664553cb5f05df182828c16c5a1
-
SSDEEP
1536:4iaq5dUQlKk6HtBPnaw/TiOibmYtbJtHvmWgDrx4GMwGV4D9UM88/Mfbyb899:LdUEH6TnB/TfibmYtlhvmWgDrx4GZG6G
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ\shell rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ\shell\ = "open" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ\shell\open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\ izÕáÚ izÕáÚ izÕáÚ°Î|NÙáÚ còüØáÚ\shell\open\command\ = " i\u0081zÕáÚ\x01 i\u0081zÕáÚ\x01 i\u0081zÕáÚ\x01°Î|NÙáÚ\x01 còüØáÚ\x01 \"%1\"" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30 PID 824 wrote to memory of 2596 824 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pictxt-v4.1\dll\RegCom.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\pictxt-v4.1\dll\RegCom.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2596
-