Overview
overview
7Static
static
7LPv.dll
windows7-x64
7LPv.dll
windows10-2004-x64
7MSCOMCTL.dll
windows7-x64
3MSCOMCTL.dll
windows10-2004-x64
3MSINET.dll
windows7-x64
3MSINET.dll
windows10-2004-x64
3MSWINSCK.dll
windows7-x64
3MSWINSCK.dll
windows10-2004-x64
3MonsterBattle.dll
windows7-x64
7MonsterBattle.dll
windows10-2004-x64
7NPSCAN.dll
windows7-x64
3NPSCAN.dll
windows10-2004-x64
3monsterpk.dll
windows7-x64
3monsterpk.dll
windows10-2004-x64
3npgmup.dll
windows7-x64
3npgmup.dll
windows10-2004-x64
3npkcrypt.dll
windows7-x64
3npkcrypt.dll
windows10-2004-x64
3npkcrypt.sys
windows7-x64
1npkcrypt.sys
windows10-2004-x64
1npkcusb.sys
windows7-x64
1npkcusb.sys
windows10-2004-x64
1npkpdb.dll
windows7-x64
3npkpdb.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 00:31
Behavioral task
behavioral1
Sample
LPv.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LPv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
MSCOMCTL.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
MSCOMCTL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
MSINET.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
MSINET.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
MSWINSCK.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
MSWINSCK.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
MonsterBattle.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
MonsterBattle.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NPSCAN.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
NPSCAN.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
monsterpk.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
monsterpk.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
npgmup.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
npgmup.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
npkcrypt.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
npkcrypt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
npkcrypt.sys
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
npkcrypt.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
npkcusb.sys
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
npkcusb.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
npkpdb.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
npkpdb.dll
Resource
win10v2004-20241007-en
General
-
Target
LPv.dll
-
Size
1.0MB
-
MD5
82f4f15b5f2710f0ae0308180ecc42c7
-
SHA1
420e14c7868dc79d01ce795d8414f0109c31be86
-
SHA256
a90ad1ae1e25bbca8115d07dace09ff66cec4e3779b300f7c453b38b519080e8
-
SHA512
c98ab45f7eb70dd077d8f6049079cfb15c786a70765ffd27b9dada75260e9066068143e4980bbecc4598892ccb94538dfa826428daeee71b7b01ed869c2e2407
-
SSDEEP
24576:JMumJWvkxJNvyIni+5rbcg+NJ9ZVL5KQd:JTavy4JrbcnbVL
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2740 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2740 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30 PID 2848 wrote to memory of 2740 2848 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LPv.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LPv.dll,#12⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2740
-