Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 10:51
Behavioral task
behavioral1
Sample
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll
-
Size
80KB
-
MD5
ca0904c7c9c8f260335223101a2a9f80
-
SHA1
975429eefe193af74517cdfa44b6c8ab397fc08d
-
SHA256
2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81
-
SHA512
b3a6df2c89593ea100f1d8ab2b45c1fba5df7bcf85a18fdd8e99d5255b0e5329ee3a3e4b5437aef615270f9cae0d731fbaf0641653e70ebf59157720f48e53d3
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEYgXfGhoxd:5dbwovEVyqgoZmZXWfIdQdRaefPtgXf/
Malware Config
Signatures
-
pid Process 2328 arp.exe 3596 arp.exe 1712 arp.exe 2716 arp.exe 3716 arp.exe 5008 arp.exe 3508 arp.exe 3592 arp.exe 4448 arp.exe -
resource yara_rule behavioral2/memory/536-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/536-2-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2372 536 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 536 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2416 wrote to memory of 536 2416 rundll32.exe 83 PID 2416 wrote to memory of 536 2416 rundll32.exe 83 PID 2416 wrote to memory of 536 2416 rundll32.exe 83 PID 536 wrote to memory of 2328 536 rundll32.exe 84 PID 536 wrote to memory of 2328 536 rundll32.exe 84 PID 536 wrote to memory of 2328 536 rundll32.exe 84 PID 536 wrote to memory of 4448 536 rundll32.exe 88 PID 536 wrote to memory of 4448 536 rundll32.exe 88 PID 536 wrote to memory of 4448 536 rundll32.exe 88 PID 536 wrote to memory of 2716 536 rundll32.exe 89 PID 536 wrote to memory of 2716 536 rundll32.exe 89 PID 536 wrote to memory of 2716 536 rundll32.exe 89 PID 536 wrote to memory of 3592 536 rundll32.exe 90 PID 536 wrote to memory of 3592 536 rundll32.exe 90 PID 536 wrote to memory of 3592 536 rundll32.exe 90 PID 536 wrote to memory of 3508 536 rundll32.exe 91 PID 536 wrote to memory of 3508 536 rundll32.exe 91 PID 536 wrote to memory of 3508 536 rundll32.exe 91 PID 536 wrote to memory of 3596 536 rundll32.exe 92 PID 536 wrote to memory of 3596 536 rundll32.exe 92 PID 536 wrote to memory of 3596 536 rundll32.exe 92 PID 536 wrote to memory of 3716 536 rundll32.exe 93 PID 536 wrote to memory of 3716 536 rundll32.exe 93 PID 536 wrote to memory of 3716 536 rundll32.exe 93 PID 536 wrote to memory of 5008 536 rundll32.exe 94 PID 536 wrote to memory of 5008 536 rundll32.exe 94 PID 536 wrote to memory of 5008 536 rundll32.exe 94 PID 536 wrote to memory of 1712 536 rundll32.exe 95 PID 536 wrote to memory of 1712 536 rundll32.exe 95 PID 536 wrote to memory of 1712 536 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2645d9eda8e00105bc65dc4b0aa03b64a4b0838a2fd2404b03f41ce800522c81N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 5a-70-45-c5-36-c23⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4448
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 a3-12-78-d4-b1-073⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2716
-
-
C:\Windows\SysWOW64\arp.exearp -s 37.27.61.185 ba-73-f9-b7-24-013⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3592
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 a6-9c-a3-a1-8e-723⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3508
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 96-3c-8c-e2-d3-d53⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3596
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 b8-84-8d-39-79-f63⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 25-5f-08-68-f3-ff3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:5008
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 3b-7a-62-de-42-1e3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 7283⤵
- Program crash
PID:2372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 536 -ip 5361⤵PID:3344