Overview
overview
10Static
static
3DHL PACKAGE - PDF.exe
windows7-x64
10DHL PACKAGE - PDF.exe
windows10-2004-x64
10$APPDATA/f...60.dll
windows7-x64
1$APPDATA/f...60.dll
windows10-2004-x64
1$APPDATA/f...xy.exe
windows7-x64
3$APPDATA/f...xy.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/2006...60.dll
windows7-x64
1$TEMP/2006...60.dll
windows10-2004-x64
1$TEMP/Situ...le.dll
windows7-x64
3$TEMP/Situ...le.dll
windows10-2004-x64
10$TEMP/mode...ap.dll
windows7-x64
3$TEMP/mode...ap.dll
windows10-2004-x64
3$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...lc.exe
windows7-x64
3$TEMP/mode...lc.exe
windows10-2004-x64
3$TEMP/mode...or.dll
windows7-x64
3$TEMP/mode...or.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
DHL PACKAGE - PDF.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
DHL PACKAGE - PDF.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/2006/35.opends60.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/2006/35.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/SitulaCystocele.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/SitulaCystocele.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/SitulaCystocele.dll
-
Size
50KB
-
MD5
de3f3ceccff80b3b0cc7e8cc58357b70
-
SHA1
701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
-
SHA256
18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
-
SHA512
ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
-
SSDEEP
1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2972 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2972 rundll32.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2360 wrote to memory of 2972 2360 rundll32.exe 31 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32 PID 2972 wrote to memory of 3020 2972 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SitulaCystocele.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SitulaCystocele.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3020
-
-