Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3GeeLark_x64_1.8.0.exe
windows10-1703-x64
8$PLUGINSDI...os.dll
windows10-1703-x64
3$PLUGINSDIR/nsDui.dll
windows10-1703-x64
3$PLUGINSDI...ss.dll
windows10-1703-x64
3DuiLib_d.dll
windows10-1703-x64
3DuiLib_u.dll
windows10-1703-x64
3DuiLib_ud.dll
windows10-1703-x64
3DuilibPreview.exe
windows10-1703-x64
3Analysis
-
max time kernel
525s -
max time network
527s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/08/2024, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
GeeLark_x64_1.8.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsDui.dll
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
DuiLib_d.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
DuiLib_u.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
DuiLib_ud.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
DuilibPreview.exe
Resource
win10-20240404-en
General
-
Target
DuiLib_ud.dll
-
Size
1.4MB
-
MD5
eb9c3d4ae276b40543cae5564664234c
-
SHA1
8871a4554ed5cdb6a9bb6d110a8a50ed1c574097
-
SHA256
9acd454a4ec92332c7c18f4d13c1777ba3f5a9ec04b06bc45face5a63b5751f0
-
SHA512
58eefb17108d52db45ec5c8d729cad5c862ddc23d8fbdd31efea701835d79e75af4de76c73def0817cadf43f4e41083e13eec3e61b348c0c771c8c6ab684afe2
-
SSDEEP
24576:GX5uOXeGlHrcXCkcPqCpQYnFOceiUN0dpl9jmB98:GX5MKLcXCVucmQpM8
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4644 2956 WerFault.exe 73 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 424 wrote to memory of 2956 424 rundll32.exe 73 PID 424 wrote to memory of 2956 424 rundll32.exe 73 PID 424 wrote to memory of 2956 424 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_ud.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_ud.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 6443⤵
- Program crash
PID:4644
-
-