Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
.dll
Resource
win10v2004-20241007-en
General
-
Target
.dll
-
Size
280KB
-
MD5
040212ac1dc3eba329c9eca081020653
-
SHA1
0cedbed4cf695e690ca160578abcae8dd954b85d
-
SHA256
6a274b735a4bf406c621f33f96b1f870c8562536cb615d33e504a054e8af1729
-
SHA512
a3a0872801b1913ad2d571e2131e250bf0eee26423dc08ea55a3f0f8af58bdd0b5bd020ac2a65725f136f954a7164877127049cb39471f3f4d27b6c3a214e08c
-
SSDEEP
3072:cUPl/0jfkOMFRbjpWmA+iE+rLqRfh4X8Y51yroMnbdOUUyo4fhX2PXjG8BZUXC2u:DB0jDMFHWmABjO01yr/nVRxfp2PTGmt
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29 PID 840 wrote to memory of 2380 840 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2380
-