Resubmissions

13/10/2024, 11:52

241013-n15qrsvdrc 5

13/10/2024, 11:50

241013-nzlaqszcqk 5

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 11:50

General

  • Target

    UnregVulkanLayer.bat

  • Size

    122B

  • MD5

    13e241026906e9c49e8dcc436313dc55

  • SHA1

    3d2c1fdb2e0166f915796569c6e4c04167aba9d3

  • SHA256

    ec319ae952e4ffac8ff5edede7029050d53452a4df9bc026de3375ecfa983a44

  • SHA512

    338fd96cad17b7f73328b9361a9a23da5c184c39a0fb185d772719daa2eb7abc268834fcba5cc2f0d6e6adf1b6364d3f7e59f9b330dba1ce769674cad295b0c7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\UnregVulkanLayer.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bdcamvk32.dll",UnregDll
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:2380
    • C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bdcamvk64.dll",UnregDll
      2⤵
        PID:2540

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads