Overview
overview
10Static
static
1DEMANDA LA...AL.exe
windows7-x64
DEMANDA LA...AL.exe
windows10-2004-x64
10DEMANDA LA...32.dll
windows7-x64
3DEMANDA LA...32.dll
windows10-2004-x64
3DEMANDA LA...32.dll
windows7-x64
3DEMANDA LA...32.dll
windows10-2004-x64
3DEMANDA LA...ar.dll
windows7-x64
3DEMANDA LA...ar.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/10/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
DEMANDA LABORAL/01DEMANDA LABORAL JDUCIAL.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DEMANDA LABORAL/01DEMANDA LABORAL JDUCIAL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DEMANDA LABORAL/madHcNet32.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
DEMANDA LABORAL/madHcNet32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
DEMANDA LABORAL/mvrSettings32.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
DEMANDA LABORAL/mvrSettings32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
DEMANDA LABORAL/unrar.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
DEMANDA LABORAL/unrar.dll
Resource
win10v2004-20241007-en
General
-
Target
DEMANDA LABORAL/mvrSettings32.dll
-
Size
1.0MB
-
MD5
d168f18b79f9f33690f011d1deb1e7cf
-
SHA1
cf0d984ce101ec274e65e88fae07daeb26de5a6d
-
SHA256
b7d3bc460a17e1b43c9ff09786e44ea4033710538bdb539400b55e5b80d0b338
-
SHA512
bbf085bcbc3c1c98caba95bdf48051bac18bbd1b7314c7bb55b56e3d423fb34758cc239c237091486cc466123bf02844eaac3b4435cb535af25dc2bca625af71
-
SSDEEP
12288:1wsE8YWuTCipwKm3ZCdX+y0Cg57ZrVmK5UhYX5NN/u3ZeEb+LJkguVl1Y1e:XIWuFKKVuig5jZ5xX5P2bKyguJf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30 PID 2872 wrote to memory of 2892 2872 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\mvrSettings32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL\mvrSettings32.dll",#12⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2892
-