Overview
overview
4Static
static
3NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1ThemeEdito...on.dll
windows7-x64
1ThemeEdito...on.dll
windows10-2004-x64
1ThemeEditor.WPF.exe
windows7-x64
3ThemeEditor.WPF.exe
windows10-2004-x64
3ThirdParty...nt.doc
windows7-x64
4ThirdParty...nt.doc
windows10-2004-x64
1ThirdParty...de.dll
windows7-x64
3ThirdParty...de.dll
windows10-2004-x64
3ThirdParty...-0.dll
windows7-x64
3ThirdParty...-0.dll
windows10-2004-x64
3ThirdParty...is.dll
windows7-x64
3ThirdParty...is.dll
windows10-2004-x64
3ThirdParty...st.exe
windows7-x64
1ThirdParty...st.exe
windows10-2004-x64
3Xceed.Wpf.Toolkit.dll
windows7-x64
1Xceed.Wpf.Toolkit.dll
windows10-2004-x64
1es/ThemeEd...es.dll
windows7-x64
1es/ThemeEd...es.dll
windows10-2004-x64
1fr/ThemeEd...es.dll
windows7-x64
1fr/ThemeEd...es.dll
windows10-2004-x64
1it/ThemeEd...es.dll
windows7-x64
1it/ThemeEd...es.dll
windows10-2004-x64
1pt-BR/Them...es.dll
windows7-x64
1pt-BR/Them...es.dll
windows10-2004-x64
1Analysis
-
max time kernel
131s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
NAudio.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
NAudio.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ThemeEditor.Common.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
ThemeEditor.Common.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ThemeEditor.WPF.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ThemeEditor.WPF.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ThirdParty/vgmstream/g7221-siren7_14_G719_license_agreement.doc
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ThirdParty/vgmstream/g7221-siren7_14_G719_license_agreement.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ThirdParty/vgmstream/libg7221_decode.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
ThirdParty/vgmstream/libg7221_decode.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ThirdParty/vgmstream/libmpg123-0.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
ThirdParty/vgmstream/libmpg123-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ThirdParty/vgmstream/libvorbis.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
ThirdParty/vgmstream/libvorbis.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ThirdParty/vgmstream/test.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ThirdParty/vgmstream/test.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Xceed.Wpf.Toolkit.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
es/ThemeEditor.WPF.resources.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
es/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
fr/ThemeEditor.WPF.resources.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
fr/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
it/ThemeEditor.WPF.resources.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
it/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
pt-BR/ThemeEditor.WPF.resources.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
pt-BR/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
General
-
Target
ThirdParty/vgmstream/libmpg123-0.dll
-
Size
197KB
-
MD5
f4dfc8c796694676dd702549c6db1f1e
-
SHA1
e57bafc6f52e08e797a4af5344415d4af93014ce
-
SHA256
0ed3cbb7da7483a624a63125986d5286e6f2bb2635a3e69640e5f1d5c4ae3e8a
-
SHA512
9342fe1353a63b190ca1449d9c81a577df7433d6be4db029e081b7dd81f93117a279866fc95ef42eaeba57eab027a6740381fd9399f9e4b913a923b937cc61f3
-
SSDEEP
6144:8Y0fUvq91hOuI3keKM8ON6bcPZRXi+Jbq:QfUvq91hOuGHJRRXiWO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1656 4284 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4284 4572 rundll32.exe 90 PID 4572 wrote to memory of 4284 4572 rundll32.exe 90 PID 4572 wrote to memory of 4284 4572 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ThirdParty\vgmstream\libmpg123-0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ThirdParty\vgmstream\libmpg123-0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 6003⤵
- Program crash
PID:1656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4284 -ip 42841⤵PID:2996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:81⤵PID:2092