Overview
overview
10Static
static
10Primordial...ix.bat
windows10-1703-x64
1Primordial...GL.dll
windows10-1703-x64
3Primordial...v2.dll
windows10-1703-x64
3Primordial...et.dll
windows10-1703-x64
3Primordial...nt.dll
windows10-1703-x64
3Primordial..._1.dll
windows10-1703-x64
3Primordial...32.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
1Primordial..._1.dll
windows10-1703-x64
3Primordial...-6.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
3Primordial...sw.dll
windows10-1703-x64
3Primordial...in.dll
windows10-1703-x64
3Primordial...ix.dll
windows10-1703-x64
1Primordial...al.exe
windows10-1703-x64
10Primordial...or.dll
windows10-1703-x64
1Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-10-2024 00:23
Behavioral task
behavioral1
Sample
Primordial/FIX/fix.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Primordial/FIX/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Primordial/FIX/libGLESv2.dll
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
Primordial/FIX/libQt-Secret.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Primordial/FIX/libQtBigint.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Primordial/FIX/libcrypto-1_1.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Primordial/FIX/libeay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Primordial/FIX/libgcc_s_dw2-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Primordial/FIX/libgcc_s_seh-1.dll
Resource
win10-20240611-en
Behavioral task
behavioral10
Sample
Primordial/FIX/libssl-1_1.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Primordial/FIX/libstdc++-6.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Primordial/FIX/libwinpthread-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Primordial/FIX/opengl32sw.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Primordial/FIX/qtquick2plugin.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Primordial/FIX/steamfix.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Primordial/Primordial.exe
Resource
win10-20240611-en
Behavioral task
behavioral17
Sample
Primordial/injector.dll
Resource
win10-20240404-en
General
-
Target
Primordial/FIX/libgcc_s_dw2-1.dll
-
Size
113KB
-
MD5
9aec524b616618b0d3d00b27b6f51da1
-
SHA1
64264300801a353db324d11738ffed876550e1d3
-
SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
-
SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
SSDEEP
3072:nti6N0WeF35Ro7hAWP6cagLSuf6LG3qSbKE4M:ti6N2F33wGJVuHuE
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4484 2344 WerFault.exe 71 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4672 wrote to memory of 2344 4672 rundll32.exe 71 PID 4672 wrote to memory of 2344 4672 rundll32.exe 71 PID 4672 wrote to memory of 2344 4672 rundll32.exe 71
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial\FIX\libgcc_s_dw2-1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial\FIX\libgcc_s_dw2-1.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 6283⤵
- Program crash
PID:4484
-
-