1d4a01ab27dfcbc32e66793b8bb758366293a432e26323e411e69097ef8aab64

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GraboidVideo/1.6.5.0/DLManager/lib/_ssl.dll
Size

640KB
MD5

358a848a41820bfae9619b2bfc448b94
SHA1

4494b4e371fff6cdf75aac0dfc63d1077105f863
SHA256

5cad42bb0f00096b9d8ddb1cb986ab7b6b9727339b503d8157d2b70606ccf9a1
SHA512

ce4d8b1bdb59a4b2c8bf44ee394ae3b77e2bf79523de575617d0df91e7e391126d5f7a1fe2480731d31631f59e831e270a7943f4939a70702fffc01892d0464d
SSDEEP

12288:UDyUk3918LaR2UWYl9hKgS+dAxpBZbVX4T:UDfkN18LaR2UNl9oqupBZpX4T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4120	1860	rundll32.exe	81
PID 1860 wrote to memory of 4120	1860	rundll32.exe	81
PID 1860 wrote to memory of 4120	1860	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GraboidVideo\1.6.5.0\DLManager\lib\_ssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GraboidVideo\1.6.5.0\DLManager\lib\_ssl.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...