Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 17:57

General

  • Target

    LEGEND注册机/1.76 连击版引擎注册/lpk.dll

  • Size

    217KB

  • MD5

    aa28054265b1c2fb7748fb21ab5984a7

  • SHA1

    2fd0396a49a7024ce53783995c4b288e7c596342

  • SHA256

    004785903afd37cace27aae4ed28b2130c2691798b82132debb42659d223b615

  • SHA512

    aaa000f7947a92e834b3175facfcefd1d9f53e3204f1b26f10c19c4c1b5ea720b6d6fc45d88a909ca0dbe425c39a6885496f8673e4ff1ebff6a709a351322e28

  • SSDEEP

    6144:u24mCyHAWyPgWITYJ0Ax9N17xM2lxq27Wo/GEvdt:u24xvPgWGYj9X7xM2Lq27D/GEvdt

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LEGEND注册机\1.76 连击版引擎注册\lpk.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\LEGEND注册机\1.76 连击版引擎注册\lpk.dll",#1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\hrl1.tmp
        C:\Users\Admin\AppData\Local\Temp\hrl1.tmp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrl1.tmp > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3040
  • C:\Windows\SysWOW64\dqljao.exe
    C:\Windows\SysWOW64\dqljao.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\hrl1.tmp

      Filesize

      209KB

      MD5

      e22252dba6642b4247d7ba4ca0411ab9

      SHA1

      5b3a1dab65446d2a1e27edccf87304d0bc6335dc

      SHA256

      947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848

      SHA512

      e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e

    • \Users\Admin\AppData\Local\Temp\dal20.tmp

      Filesize

      172KB

      MD5

      685f1cbd4af30a1d0c25f252d399a666

      SHA1

      6a1b978f5e6150b88c8634146f1406ed97d2f134

      SHA256

      0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

      SHA512

      6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

    • memory/2052-18-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2052-30-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2052-29-0x0000000000860000-0x00000000008D3000-memory.dmp

      Filesize

      460KB

    • memory/2052-23-0x0000000000860000-0x00000000008D3000-memory.dmp

      Filesize

      460KB

    • memory/2364-10-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/2364-11-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/2720-15-0x0000000000670000-0x00000000006E3000-memory.dmp

      Filesize

      460KB

    • memory/2720-12-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2720-32-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2720-31-0x0000000000670000-0x00000000006E3000-memory.dmp

      Filesize

      460KB

    • memory/2820-28-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2820-26-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2820-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB