Analysis

  • max time kernel
    66s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/11/2024, 08:12

General

  • Target

    The_Moral_Sword_of_Asagi/System/RGSS301.dll

  • Size

    1.0MB

  • MD5

    dd25855ac39d32da033902fc58fa210b

  • SHA1

    0ffa23a4d0b81438a329258f5c8d3b3403f4aa94

  • SHA256

    27647690ed16218cd988dd71069fdca67207515b2a2df775be361f0198ab6876

  • SHA512

    07f7f7cb4eda2165b4b28456fb01d4edea6e3d5f305dde19256865777905a0d0bb1d13ce1194a8639d740f633ccf1507a1b87530644d5e2d512a86829195ae60

  • SSDEEP

    24576:+pc8WbPqpzFwdPhet279ae3P7zqP2JzCNkX67Flr1nH0F3ia:+pc8W7qEdPhet2hae3HfJR2Uf

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\The_Moral_Sword_of_Asagi\System\RGSS301.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\The_Moral_Sword_of_Asagi\System\RGSS301.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3156
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 620
        3⤵
        • Program crash
        PID:2168
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3156 -ip 3156
    1⤵
      PID:4056

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3156-0-0x0000000010000000-0x0000000010324000-memory.dmp

            Filesize

            3.1MB

          • memory/3156-2-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-1-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-21-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-20-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-19-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-18-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-17-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-16-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-15-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-14-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-13-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-12-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-11-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-10-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-9-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-8-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-7-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-6-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-5-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-4-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-3-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-22-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-24-0x00000000027D0000-0x00000000027D1000-memory.dmp

            Filesize

            4KB

          • memory/3156-23-0x0000000002780000-0x0000000002784000-memory.dmp

            Filesize

            16KB

          • memory/3156-25-0x0000000010000000-0x0000000010324000-memory.dmp

            Filesize

            3.1MB

          • memory/3156-26-0x00000000027D0000-0x00000000027D1000-memory.dmp

            Filesize

            4KB

          • memory/3156-30-0x0000000000D30000-0x0000000000D31000-memory.dmp

            Filesize

            4KB

          • memory/3156-32-0x0000000002780000-0x0000000002781000-memory.dmp

            Filesize

            4KB

          • memory/3156-31-0x00000000027A0000-0x00000000027A1000-memory.dmp

            Filesize

            4KB

          • memory/3156-27-0x0000000002770000-0x0000000002771000-memory.dmp

            Filesize

            4KB

          • memory/3156-29-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

            Filesize

            4KB

          • memory/3156-28-0x0000000002790000-0x0000000002791000-memory.dmp

            Filesize

            4KB

          • memory/3156-33-0x0000000010000000-0x0000000010324000-memory.dmp

            Filesize

            3.1MB