Analysis
-
max time kernel
135s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2024 06:05
Static task
static1
Behavioral task
behavioral1
Sample
node.dll
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
node.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
node.dll
Resource
win11-20240802-en
General
-
Target
node.dll
-
Size
5.5MB
-
MD5
a1bb20106dfd3330625c98f0acaa38fe
-
SHA1
be7679e8bbebefd16c0906d15d775b81d81b73aa
-
SHA256
8d31c14a59cccb093ad1264c43e4d032a9cfcefeaa0d45b6862a5776c44fff37
-
SHA512
48bbb35a4f59388dfed8edb85640f0c1dcbd9a8c49dbf16cf7f8fee3d67ffa66afda827a8703564758f86dc5ea4c0727294df5140b234187e50138ad29e4f64f
-
SSDEEP
49152:9vJjhvv6FzlQKxCjGj+Vd4OscisICzSHgn/1ooOEO3/8CJtQmqFkCn3sSJ5hp6AH:95hvydfkj2m4WIu/1IvKP4m
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31132250" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1495568472" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a9125d5a0adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2051045d5a0adb01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1495568472" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31132250" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055eccefc1ffa9344b818883976e57f5900000000020000000000106600000001000020000000b8824447b571184add4d61bce06c0c07be4cf6513ea1f2f8d52a9fdd5e222cdd000000000e8000000002000020000000c6f2603e9a58ba21a7c562e775c9ca37c19f912b17554d1ff06383020f3d571f2000000003818d479c3f6bdf88c5c8c0522fbd598f55301d1f775dfec62fbff0e3531d8040000000da116fea73fa8dccd21737ead0e319a784eb24e0faf7bc428ed3952ec64ba96d92660010516043d4d4191c33f3d165ad0c01b6bd14eed2562060edb339695bb0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84974296-764D-11EF-9650-FA732297E4B8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055eccefc1ffa9344b818883976e57f5900000000020000000000106600000001000020000000a451bfb4c489f3b173973ba6a978c773e8b56d19985aa4d2a12217ba92bcb046000000000e8000000002000020000000cbdfb45f6c1b094a2fedc505270915936a11cdf752a777f1e59477cd0755ddcb20000000acd29d52888c92cbed60a0c2f6ded63b57277948902f595325a0ca03d76ad94b400000006d0b34a08f9b303d12fcb6c29927f3d2b5c70310f0c57a766be2d2f3c79b331efed69239f966880e41dfb40242a2b479230fbea918118ce57251b9436be1b628 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4544 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4544 iexplore.exe 4544 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3336 wrote to memory of 672 3336 rundll32.exe 70 PID 3336 wrote to memory of 672 3336 rundll32.exe 70 PID 3336 wrote to memory of 672 3336 rundll32.exe 70 PID 4544 wrote to memory of 2680 4544 iexplore.exe 73 PID 4544 wrote to memory of 2680 4544 iexplore.exe 73 PID 4544 wrote to memory of 2680 4544 iexplore.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\node.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\node.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:672
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:82945 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-