Overview
overview
10Static
static
3readyfile.zip
windows10-ltsc 2021-x64
10✱SatUp/Setup.exe
windows10-ltsc 2021-x64
10✱SatUp/libvlc.dll
windows10-ltsc 2021-x64
1✱SatUp/l...re.dll
windows10-ltsc 2021-x64
1✱SatUp/pdfium.dll
windows10-ltsc 2021-x64
3✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1✱SatUp/p...in.dll
windows10-ltsc 2021-x64
1Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
07/11/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
readyfile.zip
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
✱SatUp/Setup.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
✱SatUp/libvlc.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
✱SatUp/libvlccore.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
✱SatUp/pdfium.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
✱SatUp/plugins/access/libfilesystem_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
✱SatUp/plugins/access/libimem_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
✱SatUp/plugins/audio_output/libdirectsound_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
✱SatUp/plugins/audio_output/libwasapi_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
✱SatUp/plugins/codec/libavcodec_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
✱SatUp/plugins/codec/libd3d11va_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral12
Sample
✱SatUp/plugins/video_output/libdirect3d11_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral13
Sample
✱SatUp/plugins/video_output/libdirect3d9_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral14
Sample
✱SatUp/plugins/video_output/libdrawable_plugin.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral15
Sample
✱SatUp/plugins/video_output/libvmem_plugin.dll
Resource
win10ltsc2021-20241023-en
General
-
Target
✱SatUp/pdfium.dll
-
Size
4.3MB
-
MD5
8057f67de20331fb5dad3fd9486b01c3
-
SHA1
067e470192707b8f5eaa757bf4b121c94d505795
-
SHA256
fcbc591306dc6e4840de82372886428dd2260af4f9b7fe8494510aa1a80761eb
-
SHA512
68dedc7e5ba8fa16f18ded8ef811a41ecd9441639181b0a6e0854db96c7c0e35abe088c8409f226a42f3beb85139fbf67cd9de1c02325701a7482ac7fb6bd372
-
SSDEEP
98304:p3o9vEPXcE+Dq3/OW5q41yIpK6xpz/7owISRMGHLPaC0wnGCICCDnx:iNqmWsrS9PaxCICCrx
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 952 2024 WerFault.exe 81 4092 2024 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2024 4888 rundll32.exe 81 PID 4888 wrote to memory of 2024 4888 rundll32.exe 81 PID 4888 wrote to memory of 2024 4888 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\✱SatUp\pdfium.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\✱SatUp\pdfium.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 5883⤵
- Program crash
PID:952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 8043⤵
- Program crash
PID:4092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2024 -ip 20241⤵PID:4924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2024 -ip 20241⤵PID:2020