Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28-08-2024 21:54
Static task
static1
Behavioral task
behavioral1
Sample
softokn3.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
softokn3.dll
Resource
win10v2004-20240802-en
General
-
Target
softokn3.dll
-
Size
251KB
-
MD5
4e52d739c324db8225bd9ab2695f262f
-
SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889
-
SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
-
SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
-
SSDEEP
6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe PID 708 wrote to memory of 2300 708 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\softokn3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\softokn3.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2300