Overview
overview
10Static
static
3JJSploit_8...up.exe
windows11-21h2-x64
10$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3JJSploit.dll
windows11-21h2-x64
1JJSploit.exe
windows11-21h2-x64
6libcrypto-3-x64.dll
windows11-21h2-x64
1libssl-3-x64.dll
windows11-21h2-x64
1resources/...bot.js
windows11-21h2-x64
3resources/...lip.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3xxhash.dll
windows11-21h2-x64
1zstd.dll
windows11-21h2-x64
1Analysis
-
max time kernel
431s -
max time network
1155s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-09-2024 07:34
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_8.4.1_x64-setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
JJSploit.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
JJSploit.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
libcrypto-3-x64.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
libssl-3-x64.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
resources/luascripts/general/aimbot.js
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
resources/luascripts/general/noclip.js
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
xxhash.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
zstd.dll
Resource
win11-20240802-en
General
-
Target
$PLUGINSDIR/nsis_tauri_utils.dll
-
Size
29KB
-
MD5
8def0196223484f8aed4106148dd3f08
-
SHA1
e0fc0951deb0e5e741df10328f95c7d6678ad3aa
-
SHA256
c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333
-
SHA512
9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7
-
SSDEEP
768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2596 3936 rundll32.exe 78 PID 3936 wrote to memory of 2596 3936 rundll32.exe 78 PID 3936 wrote to memory of 2596 3936 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis_tauri_utils.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis_tauri_utils.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2596
-