Overview
overview
7Static
static
77529a7f99a...1N.exe
windows7-x64
77529a7f99a...1N.exe
windows10-2004-x64
7$PLUGINSDI...ay.dll
windows7-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
5$PLUGINSDI...on.dll
windows10-2004-x64
5Analysis
-
max time kernel
93s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:26
Behavioral task
behavioral1
Sample
7529a7f99a91ef3fa6cb96ad8babd5b953b1643f50c14328b803a9806dd72361N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7529a7f99a91ef3fa6cb96ad8babd5b953b1643f50c14328b803a9806dd72361N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/version.dll
Resource
win7-20240903-en
General
-
Target
$PLUGINSDIR/newadvsplash.dll
-
Size
8KB
-
MD5
55a723e125afbc9b3a41d46f41749068
-
SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
-
SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
-
SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
-
SSDEEP
96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30 PID 844 wrote to memory of 1916 844 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\newadvsplash.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\newadvsplash.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1916
-