bca698746822f926ebed94c6d84fb82cdf795c8fe7b5e7e31aeaa78aff96d236

Analysis

max time kernel
108s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1663c8985482c06fb8bd334dd3e904e0N.dll
Size

5KB
MD5

1663c8985482c06fb8bd334dd3e904e0
SHA1

50d5ec4a04d159313331e306fc25828e2fc7a219
SHA256

bca698746822f926ebed94c6d84fb82cdf795c8fe7b5e7e31aeaa78aff96d236
SHA512

e09996f2ce5da5a898ec344fc190b630a1279e627179c4c576538f10efae7a0f92eb623f180807b508a8d25b44d976f821ba3dcca5c09e5bf741a4769ec85f18
SSDEEP

96:hy859x0P8MalfptqFxwCy15zR9kfXBW1:F5oLmpsFCP11UfxW1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4120	1372	rundll32.exe	84
PID 1372 wrote to memory of 4120	1372	rundll32.exe	84
PID 1372 wrote to memory of 4120	1372	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1663c8985482c06fb8bd334dd3e904e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1663c8985482c06fb8bd334dd3e904e0N.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...