341dfa8cc975233055495070cb6ef14918f458710cc5826e789567ba3ec0f497

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FoxBurner.dll
Size

916KB
MD5

fd7941675b832776c46bab4435e42289
SHA1

b31fc29a4606a4322dae1dd73e7f2b8a3fc8086b
SHA256

f34071e898f8a4ee5147e2535dc2bd1792c339a8814b1a9f3aacafe1727a1578
SHA512

a3795abc39855f3e2344f1961578aa343005660f755d15f6fba07f0c0fb9a2a6296b4fc3418a3bcb4a906df1ab92a1edb469ba647b10d76dfe6a06dc710f91ae
SSDEEP

12288:ZWKAvv9O1FjI4vVHzf2fpkhgeSemY37Fghcy96pNKnqTQ0ZUcGAQkuxLgZtTZtJK:zAvv9O3ZRgLnKUZIAyO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 456	3168	rundll32.exe	91
PID 3168 wrote to memory of 456	3168	rundll32.exe	91
PID 3168 wrote to memory of 456	3168	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FoxBurner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FoxBurner.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4100,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads