Analysis
-
max time kernel
91s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
.dll
Resource
win10v2004-20241007-en
General
-
Target
.dll
-
Size
280KB
-
MD5
040212ac1dc3eba329c9eca081020653
-
SHA1
0cedbed4cf695e690ca160578abcae8dd954b85d
-
SHA256
6a274b735a4bf406c621f33f96b1f870c8562536cb615d33e504a054e8af1729
-
SHA512
a3a0872801b1913ad2d571e2131e250bf0eee26423dc08ea55a3f0f8af58bdd0b5bd020ac2a65725f136f954a7164877127049cb39471f3f4d27b6c3a214e08c
-
SSDEEP
3072:cUPl/0jfkOMFRbjpWmA+iE+rLqRfh4X8Y51yroMnbdOUUyo4fhX2PXjG8BZUXC2u:DB0jDMFHWmABjO01yr/nVRxfp2PTGmt
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4968 2736 rundll32.exe 83 PID 2736 wrote to memory of 4968 2736 rundll32.exe 83 PID 2736 wrote to memory of 4968 2736 rundll32.exe 83 PID 4968 wrote to memory of 1876 4968 rundll32.exe 84 PID 4968 wrote to memory of 1876 4968 rundll32.exe 84 PID 4968 wrote to memory of 1876 4968 rundll32.exe 84 PID 1876 wrote to memory of 3324 1876 rundll32.exe 85 PID 1876 wrote to memory of 3324 1876 rundll32.exe 85 PID 1876 wrote to memory of 3324 1876 rundll32.exe 85 PID 3324 wrote to memory of 3940 3324 rundll32.exe 86 PID 3324 wrote to memory of 3940 3324 rundll32.exe 86 PID 3324 wrote to memory of 3940 3324 rundll32.exe 86 PID 3940 wrote to memory of 4440 3940 rundll32.exe 87 PID 3940 wrote to memory of 4440 3940 rundll32.exe 87 PID 3940 wrote to memory of 4440 3940 rundll32.exe 87 PID 4440 wrote to memory of 3260 4440 rundll32.exe 88 PID 4440 wrote to memory of 3260 4440 rundll32.exe 88 PID 4440 wrote to memory of 3260 4440 rundll32.exe 88 PID 3260 wrote to memory of 3664 3260 rundll32.exe 89 PID 3260 wrote to memory of 3664 3260 rundll32.exe 89 PID 3260 wrote to memory of 3664 3260 rundll32.exe 89 PID 3664 wrote to memory of 2968 3664 rundll32.exe 90 PID 3664 wrote to memory of 2968 3664 rundll32.exe 90 PID 3664 wrote to memory of 2968 3664 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#17⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\.dll,#19⤵
- System Location Discovery: System Language Discovery
PID:2968
-
-
-
-
-
-
-
-