Overview
overview
7Static
static
6Dokan.exe
windows7-x64
7Dokan.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PROGRAMFI...ME.url
windows7-x64
6$PROGRAMFI...ME.url
windows10-2004-x64
6$PROGRAMFI...tl.exe
windows7-x64
1$PROGRAMFI...tl.exe
windows10-2004-x64
3$PROGRAMFI...ard.js
windows7-x64
3$PROGRAMFI...ard.js
windows10-2004-x64
3$PROGRAMFI...pt.vbs
windows7-x64
1$PROGRAMFI...pt.vbs
windows10-2004-x64
1$PROGRAMFI...er.exe
windows7-x64
1$PROGRAMFI...er.exe
windows10-2004-x64
3$PROGRAMFI...or.exe
windows7-x64
3$PROGRAMFI...or.exe
windows10-2004-x64
3$PROGRAMFI...ME.url
windows7-x64
6$PROGRAMFI...ME.url
windows10-2004-x64
6$PROGRAMFI...tl.exe
windows7-x64
1$PROGRAMFI...tl.exe
windows10-2004-x64
1$PROGRAMFI...ard.js
windows7-x64
3$PROGRAMFI...ard.js
windows10-2004-x64
3$PROGRAMFI...pt.vbs
windows7-x64
1$PROGRAMFI...pt.vbs
windows10-2004-x64
1$PROGRAMFI...er.exe
windows7-x64
1$PROGRAMFI...er.exe
windows10-2004-x64
1$PROGRAMFI...or.exe
windows7-x64
1$PROGRAMFI...or.exe
windows10-2004-x64
1$SYSDIR/dokan.dll
windows7-x64
3$SYSDIR/dokan.dll
windows10-2004-x64
3$SYSDIR/dokannp.dll
windows7-x64
3$SYSDIR/dokannp.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 21:32
Behavioral task
behavioral1
Sample
Dokan.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dokan.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PROGRAMFILES/Dokan/DokanLibrary/README.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PROGRAMFILES/Dokan/DokanLibrary/README.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PROGRAMFILES/Dokan/DokanLibrary/dokanctl.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PROGRAMFILES/Dokan/DokanLibrary/dokanctl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PROGRAMFILES/Dokan/DokanLibrary/include/fuse/ScopeGuard.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PROGRAMFILES/Dokan/DokanLibrary/include/fuse/ScopeGuard.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PROGRAMFILES/Dokan/DokanLibrary/include/fuse/fuse_opt.vbs
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
$PROGRAMFILES/Dokan/DokanLibrary/include/fuse/fuse_opt.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/Dokan/DokanLibrary/mounter.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/Dokan/DokanLibrary/mounter.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/Dokan/DokanLibrary/sample/mirror/mirror.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/Dokan/DokanLibrary/sample/mirror/mirror.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/README.url
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/README.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/dokanctl.exe
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/dokanctl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/include/fuse/ScopeGuard.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/include/fuse/ScopeGuard.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/include/fuse/fuse_opt.vbs
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/include/fuse/fuse_opt.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/mounter.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/mounter.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/sample/mirror/mirror.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PROGRAMFILES64/Dokan/DokanLibrary/sample/mirror/mirror.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$SYSDIR/dokan.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$SYSDIR/dokan.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$SYSDIR/dokannp.dll
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
$SYSDIR/dokannp.dll
Resource
win10v2004-20241007-en
General
-
Target
$SYSDIR/dokan.dll
-
Size
37KB
-
MD5
aabd2e7fb2fd1036fd1ba8f1c5d1386b
-
SHA1
7e00b00237fd7784a75ff9dfcc24c56d0d801e4f
-
SHA256
a72a2544d8ab64094dddc759d26300581e03ae6b736ee0bfba67171e1cb6d148
-
SHA512
26e70bfbb590922f5d761215af3522eddc29425ea33637ea1deeda7cb89db412bc0e1ed4eb1aaca89462962829226582fec13e40affddae74a1af0797d7d4992
-
SSDEEP
768:JJuJRvI2ALAGUg00j0M6mYLnYqYyKMeEtMqGmx4:JJuJ1PAL10M6LYqYKeIgx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28 PID 1044 wrote to memory of 2272 1044 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\dokan.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\dokan.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2272
-