6ac3277dd8ae01a42bdc63a75d35584a01142bd4be244510f856ac8c84322e1c

Analysis

max time kernel
95s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPfolder/ortmp/freebl3.dll
Size

296KB
MD5

a3c1cba32232b8c28d3551fb78307058
SHA1

0c07aee705c8e10d4b4cb9af43f0f6722e7f4c3a
SHA256

ee912f5dcb516747d4ab5497e4a61cfbc413efab61fafbca6646a320cf07f601
SHA512

c7f7bb85db1d1a15deb9dc862f7eefa19203bdf22b582ea0f31973dbba9abbeab7fb7babd32c2037f7c9411c747c7fb91762ef18cf1642ef1edd3072f1875765
SSDEEP

6144:y6uQXzEKoFU1cMeRX+wsE0qMbPpErdJIkE2qwQqqDL67PXGHrIrm:TuQXzEVVsE0qgxE5JIkPVVqn6jIp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 2060	3268	rundll32.exe	82
PID 3268 wrote to memory of 2060	3268	rundll32.exe	82
PID 3268 wrote to memory of 2060	3268	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\freebl3.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads