a02efa510ddb198bba1ba69829eb943384eacd278467e7ab94a33b335e77ade3

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOS高手速成手册繁体中文版/lpk.dll
Size

46KB
MD5

da13f824f78517b9d5306532b7d56492
SHA1

8b50d78846a38a79b16ca6163ab005ecb6247677
SHA256

3f9ed957a687c9b779b1f397fd8a486cc1f9d837df76a6e4b377f9b7eb2d092b
SHA512

5a9b1c54ef5a59ba8c9d7a5a51e1e0eeac8bccce718a4159d10cb5e0049d9f0573b6075399e0e6bf207d9d872900e15dffefbf8ce410aa73f169a66f74fc00c2
SSDEEP

768:hojY9Pta9++bwNwGYN9i+Cp2+UGj0W3eE1Y2avXooyzYojY9Po:0mG++bwNwqp27GjV3P1Yj4oyzxmg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4804	hrlB120.tmp
4156	ibcjtk.exe

Loads dropped DLL 1 IoCs

pid	Process
4156	ibcjtk.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ibcjtk.exe	hrlB120.tmp
File opened for modification	C:\Windows\SysWOW64\ibcjtk.exe	hrlB120.tmp
File created	C:\Windows\SysWOW64\hra33.dll	ibcjtk.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrlB120.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibcjtk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4804	hrlB120.tmp
4804	hrlB120.tmp
4156	ibcjtk.exe
4156	ibcjtk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3484	2892	rundll32.exe	85
PID 2892 wrote to memory of 3484	2892	rundll32.exe	85
PID 2892 wrote to memory of 3484	2892	rundll32.exe	85
PID 3484 wrote to memory of 4804	3484	rundll32.exe	87
PID 3484 wrote to memory of 4804	3484	rundll32.exe	87
PID 3484 wrote to memory of 4804	3484	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DOS高手速成手册繁体中文版\lpk.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DOS高手速成手册繁体中文版\lpk.dll",#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\hrlB120.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlB120.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4804

C:\Windows\SysWOW64\ibcjtk.exe
C:\Windows\SysWOW64\ibcjtk.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrlB120.tmp

Filesize
38KB

MD5
754259ff98ffb8bbc408ed9dc5db85d8

SHA1
2386fdad8e0f773e1051a07308fcc57a174db484

SHA256
d5d9ee1d998059f41c3480c999cd15b9e52f163b464b0c059ccbc8e862edd535

SHA512
5e3cedbb1839364c245c5e16d5dd50db6b9597fa11cf670c8320dfb217b7166e39c7e81f979045a05877aa30d7c46d7370176e8614ff847334f6c2e0097d454e

Download Submit
C:\Windows\SysWOW64\hra33.dll

Filesize
7KB

MD5
7147ff24579a477a1a34696926e573f1

SHA1
9127ea8d813ecd5788b3f97777931ec79b7760e9

SHA256
fd08dcb016611316c849d48312ba6dc7d4de75d1a81c1d475a13bb5a1ba07267

SHA512
077b68376679c30d2dbae460ed59f5131c177bdd7574af1c2660ed97ae242b1401816d012af321c278be065b49bc9eab395e008b1b9a2447aa27b694bbed1d5d

Download Submit
memory/4804-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download