Analysis

  • max time kernel
    90s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2024 12:52

General

  • Target

    Calamari/sxlib.dll

  • Size

    864KB

  • MD5

    d00e1627d7536022dd81aeb27577221c

  • SHA1

    56a1f78e5acc89b97b02652f61a154265511ffcf

  • SHA256

    904a9329bf56d110adec486f37411831a1148934a5ca4bbff9e33a1ca8ce5bcb

  • SHA512

    d7cb95dd515f1edfde7e17681563bf5b709ac06f33805ce70dbcb76aca4ee34061c5201a54e1a92d67a1fb8f59512c8a64fcbb201fc88e5536001e40489dab69

  • SSDEEP

    12288:EnfEbmXVMomkzPuY6TZNPERW1v+wUGx6tEhPaZLuabPIkLOh/1K9FaUQmUFv7SZR:WhziXGGv+T8wECFIMOYHUv7S/WkuvA

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Calamari\sxlib.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Calamari\sxlib.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads