Overview
overview
10Static
static
3QtCore4.dll
windows7-x64
3QtCore4.dll
windows10-2004-x64
3QtGui4.dll
windows7-x64
3QtGui4.dll
windows10-2004-x64
3QtNetwork4.dll
windows7-x64
3QtNetwork4.dll
windows10-2004-x64
3QtWebKit4.dll
windows7-x64
3QtWebKit4.dll
windows10-2004-x64
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10ccme_ecc.dll
windows7-x64
1ccme_ecc.dll
windows10-2004-x64
1icucnv67.msi
windows7-x64
6icucnv67.msi
windows10-2004-x64
6icudt67.msi
windows7-x64
6icudt67.msi
windows10-2004-x64
6msvcp100.dll
windows7-x64
3msvcp100.dll
windows10-2004-x64
3msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3vcomp140.dll
windows7-x64
1vcomp140.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1x86/ACE.dll
windows7-x64
3x86/ACE.dll
windows10-2004-x64
3x86/AGM.dll
windows7-x64
3x86/AGM.dll
windows10-2004-x64
3x86/AIDE.dll
windows7-x64
3x86/AIDE.dll
windows10-2004-x64
3x86/Acroba...OL.dll
windows7-x64
3x86/Acroba...OL.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
QtCore4.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QtCore4.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
QtGui4.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
QtGui4.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
QtNetwork4.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
QtNetwork4.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
QtWebKit4.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
QtWebKit4.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ccme_ecc.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ccme_ecc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
icucnv67.msi
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
icucnv67.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
icudt67.msi
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
icudt67.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
msvcp100.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
msvcp100.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
msvcr100.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
msvcr100.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
vcomp140.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
vcomp140.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
vcruntime140.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
vcruntime140.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
x86/ACE.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
x86/ACE.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
x86/AGM.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
x86/AGM.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
x86/AIDE.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
x86/AIDE.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
x86/Acrobat/Acrobat32OL.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
x86/Acrobat/Acrobat32OL.dll
Resource
win10v2004-20240802-en
General
-
Target
msvcr100.dll
-
Size
752KB
-
MD5
67ec459e42d3081dd8fd34356f7cafc1
-
SHA1
1738050616169d5b17b5adac3ff0370b8c642734
-
SHA256
1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
-
SHA512
9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
-
SSDEEP
12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2548 2480 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2252 wrote to memory of 2480 2252 rundll32.exe 30 PID 2480 wrote to memory of 2548 2480 rundll32.exe 31 PID 2480 wrote to memory of 2548 2480 rundll32.exe 31 PID 2480 wrote to memory of 2548 2480 rundll32.exe 31 PID 2480 wrote to memory of 2548 2480 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr100.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcr100.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 2203⤵
- Program crash
PID:2548
-
-