Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 08:57
Static task
static1
Behavioral task
behavioral1
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
7f4a854abf13869f8b0f3c8952a1d4b0
-
SHA1
41c1dc531094abb81e5c37a04e7b88da14dd3980
-
SHA256
971b9daea9ad21621ac81776c13fdd899979ab920fed44c9066a41f60b961a4c
-
SHA512
df775a146adb801659bfec3921cf66975c8fa1425c66081ac168dc6294151d4a05c0c478d3d86fb445176bc7e775bd0165e8900d4354783ecdb9fab58a612dbe
-
SSDEEP
96:T7fhZwXd8KgEbAa9PweF1WxD8ZLMJGgmkNW38:0N8KgWAuLWxD8ZAGgmkN
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4172 4956 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3516 wrote to memory of 4956 3516 rundll32.exe 82 PID 3516 wrote to memory of 4956 3516 rundll32.exe 82 PID 3516 wrote to memory of 4956 3516 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 6123⤵
- Program crash
PID:4172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 49561⤵PID:3276