Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
Resource
win10v2004-20241007-en
General
-
Target
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll
-
Size
137KB
-
MD5
6e93d2f5ffab3061e8e01fa7e356f270
-
SHA1
192f27b3b11a0f2c10790830fa15cb23cefb084c
-
SHA256
4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89
-
SHA512
25a6acb46814f89c9c38e230c8539dc7350fb3b98dee63d59f7dd2e69e5c225de678ae047fefaff7ad96f1d096721355e568efde6afa56bf252f844a55ffa7c2
-
SSDEEP
3072:NR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:A25GgFny61mra
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2460 2492 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2452 wrote to memory of 2492 2452 rundll32.exe 30 PID 2492 wrote to memory of 2460 2492 rundll32.exe 31 PID 2492 wrote to memory of 2460 2492 rundll32.exe 31 PID 2492 wrote to memory of 2460 2492 rundll32.exe 31 PID 2492 wrote to memory of 2460 2492 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf4716f676a2f04988b968c5004fe83d363f1e11d09fdb9071a780116eabe89N.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 2283⤵
- Program crash
PID:2460
-
-