40e87b453eee20b6c010483bd7dfb0372e5d1ed8baa196826c13f3bfab8276c9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-es
resource tags

arch:x64arch:x86image:win7-20240729-eslocale:es-esos:windows7-x64systemwindows
submitted
07/09/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

imageformats/qgif.dll
Size

36KB
MD5

d46a94990ef205ce91720924e9825498
SHA1

709016f760fbff9e49cb4236487397a702be09b8
SHA256

081299a41cf833ee10db061357b0c061b67fc15aec925b403e931b7fc1ecc330
SHA512

a2155617bb2c12f43a0f04d08ab5380694185f7b1b459fb974b7c1a8702972089b1cb0b0a978c670028fac2c5ad36fe47ad0d547baecd2b81aa25e4f8e5f81eb
SSDEEP

768:h5tXpR/Qc+97XUy99Z9QQTsBl/Rafh/68FhpUkYihPxWEwgU:3tXnQD97BZVTsBl/cfh/68FhpUk7hPxA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31
PID 2192 wrote to memory of 772	2192	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads