Overview
overview
7Static
static
3virussign.exe
windows7-x64
1virussign.exe
windows10-2004-x64
3virussign.exe
windows7-x64
7virussign.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3virussign.exe
windows7-x64
7virussign.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3virussign.exe
windows7-x64
4virussign.exe
windows10-2004-x64
4virussign.exe
windows7-x64
1virussign.exe
windows10-2004-x64
3virussign.exe
windows7-x64
3virussign.exe
windows10-2004-x64
3virussign.dll
windows7-x64
3virussign.dll
windows10-2004-x64
3virussign.dll
windows7-x64
3virussign.dll
windows10-2004-x64
3virussign.dll
windows7-x64
3virussign.dll
windows10-2004-x64
3virussign.exe
windows7-x64
3virussign.exe
windows10-2004-x64
3virussign.dll
windows7-x64
3virussign.dll
windows10-2004-x64
3virussign.dll
windows7-x64
3virussign.dll
windows10-2004-x64
3virussign.exe
windows7-x64
1virussign.exe
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
virussign.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
virussign.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ProcDll.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ProcDll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
virussign.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
virussign.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
virussign.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
virussign.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
virussign.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
virussign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
virussign.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
virussign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
virussign.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
virussign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
virussign.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
virussign.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
virussign.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
virussign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
virussign.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
virussign.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
virussign.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
virussign.exe
Resource
win10v2004-20240802-en
General
-
Target
virussign.dll
-
Size
82KB
-
MD5
3ac2fbe3d48dfdf1397b178b0a916225
-
SHA1
4588dc8de795f5fadd893935568724e86c3dc8cf
-
SHA256
8350ddfd30fd1550ba21bdb19ed615310b47bc995cfc8d7f7aceca578958de89
-
SHA512
394c482777c7ef0f17010b16a8f729e746ee44a78e952355e9dfa9b7f01bec19f81f618c576de2b657c6c62f3184034bb8912184dc583dca5d909bd7ff7165a2
-
SSDEEP
1536:afE+EenJ66gVt8VYG/Ocjl/acHhDBFuPwtMe:cE+R6eJOAl/JBDBkPI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4288 wrote to memory of 4172 4288 regsvr32.exe 86 PID 4288 wrote to memory of 4172 4288 regsvr32.exe 86 PID 4288 wrote to memory of 4172 4288 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\virussign.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\virussign.dll2⤵
- System Location Discovery: System Language Discovery
PID:4172
-