2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N.dll
Size

304KB
MD5

2d9731e71e1d41cba43e65e485e37080
SHA1

8f2fb0273d7fdc675fdf9c5198f93dc0dfa919ec
SHA256

2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01
SHA512

29da57290a09851920a5f2eac455bb20cd4b1ddf2676b497b7da3df1fae5d2c41126eafe5c3ee59316daf301f0965ad45d00c318a013bc0211b065c68b75cf86
SSDEEP

6144:nIpKCyUJZcPEOuCOqqXKqmKeAro5VZc+VXOaA7/7Wff+7y:I4+JZcPRQXKrHArGjl10/yO7y

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2272	rundll32.exe
2272	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA37ED15095343520823C7FB8308527484\PowerShellRunner.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA37ED15095343520823C7FB8308527484\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA37ED15095343520823C7FB8308527484\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2556 wrote to memory of 2540	2556	rundll32.exe	30
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31
PID 2540 wrote to memory of 2272	2540	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2b47995108cafa5c8d4de84f71c1507541b7e70f92a2e906050eba0c8e2f3c01N.dll",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259441815 262494
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Installer\SFXCA37ED15095343520823C7FB8308527484\WixToolset.Dtf.WindowsInstaller.dll

Filesize
193KB

MD5
0b05c070928a2ec6a27d4d93da87da53

SHA1
227ae52b14838e066917225dfb18e3a16310a5b6

SHA256
4e1cd9b104c6ed11c21e11673bbe3fae550e04ffabe3f5c556b2673a247b7ac1

SHA512
a640dcf46855d07a40b5d18ce925ab981a90dadda2cccdb62c9f86f7766894d74204609c6c6af3b083854cbfa0e2129f4d4b63ca140e9e134ebf974939b5854e

Download Submit
memory/2272-4-0x0000000073B7E000-0x0000000073B7F000-memory.dmp

Filesize
4KB

Download
memory/2272-9-0x0000000001D00000-0x0000000001D34000-memory.dmp

Filesize
208KB

Download
memory/2272-14-0x0000000073B70000-0x000000007425E000-memory.dmp

Filesize
6.9MB

Download
memory/2272-16-0x0000000073B70000-0x000000007425E000-memory.dmp

Filesize
6.9MB

Download