Overview
overview
3Static
static
3Odin Downl...s.xlsx
windows7-x64
3Odin Downl...s.xlsx
windows10-1703-x64
1Odin Downl...s.xlsx
windows10-2004-x64
1Odin Downl...s.xlsx
windows11-21h2-x64
1Odin3 v3.13.1.exe
windows7-x64
3Odin3 v3.13.1.exe
windows10-1703-x64
3Odin3 v3.13.1.exe
windows10-2004-x64
3Odin3 v3.13.1.exe
windows11-21h2-x64
3S1PlugIn.b...19.zip
windows7-x64
1S1PlugIn.b...19.zip
windows10-1703-x64
1S1PlugIn.b...19.zip
windows10-2004-x64
1S1PlugIn.b...19.zip
windows11-21h2-x64
1SS_DL.dll
windows7-x64
3SS_DL.dll
windows10-1703-x64
3SS_DL.dll
windows10-2004-x64
3SS_DL.dll
windows11-21h2-x64
3Resubmissions
29-09-2024 15:11
240929-sk3npaseqc 329-09-2024 15:08
240929-sh684aygkk 329-09-2024 15:07
240929-shbr7ayfqn 7Analysis
-
max time kernel
205s -
max time network
264s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-09-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
Odin Downloader Release Notes.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Odin Downloader Release Notes.xlsx
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Odin Downloader Release Notes.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Odin Downloader Release Notes.xlsx
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Odin3 v3.13.1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Odin3 v3.13.1.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Odin3 v3.13.1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Odin3 v3.13.1.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
S1PlugIn.bundle_20171019.zip
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
S1PlugIn.bundle_20171019.zip
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
S1PlugIn.bundle_20171019.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
S1PlugIn.bundle_20171019.zip
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
SS_DL.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
SS_DL.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
SS_DL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
SS_DL.dll
Resource
win11-20240802-en
General
-
Target
SS_DL.dll
-
Size
2.4MB
-
MD5
28264b046fb1adff61c4372d53e3d633
-
SHA1
8c7b6e25e2d8a50b763f7617196d451f703e7bd3
-
SHA256
66047e604bca2ef6562059279a33865b80554535a051fc58919a1227674f4d2c
-
SHA512
7cccee528e90168222f2ffd8d78cf483278586cce1c872b6e0e31d57e8574b19a71079ae382fb5ccb3bcae6c302d4c6469d29f365a0edcae73b33a4ad5ab03fa
-
SSDEEP
49152:cHyzwwebNuaLn5x6kn8PzioU5v6HcjalGfnXwSC0kS1F2LTp0E3:cHyzw/N7Ln1n8PzrU5v6HcjKknA10kS1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 216 1016 WerFault.exe 73 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1016 5080 rundll32.exe 73 PID 5080 wrote to memory of 1016 5080 rundll32.exe 73 PID 5080 wrote to memory of 1016 5080 rundll32.exe 73
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SS_DL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SS_DL.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 6763⤵
- Program crash
PID:216
-
-