Analysis
-
max time kernel
96s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 00:04
Static task
static1
Behavioral task
behavioral1
Sample
fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll
Resource
win7-20240903-en
General
-
Target
fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll
-
Size
170KB
-
MD5
8d1a318e14221eddf86af0c50f6cb8e4
-
SHA1
162763d9debb02777701acceef260ee7fda347ff
-
SHA256
fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd
-
SHA512
18adafb8e7c14b101c7097e67d4c99da25d76a065893be945a81af03092cf025ef4940b21bc95eff7dea4d39dc014de783c30e8604378a56a0727a67ab3c0ce3
-
SSDEEP
3072:bcwO/iTOdgWtJ6LkHn/rkiENpYrvQaSISixCC/xwp2rrUDf:bDTOdgWtYCjkR/YrvQaSrcwptDf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 588 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000c000000023b2d-4.dat upx behavioral2/memory/588-8-0x0000000000400000-0x0000000000477000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3496 588 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4040 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3248 wrote to memory of 4040 3248 rundll32.exe 83 PID 3248 wrote to memory of 4040 3248 rundll32.exe 83 PID 3248 wrote to memory of 4040 3248 rundll32.exe 83 PID 4040 wrote to memory of 588 4040 rundll32.exe 84 PID 4040 wrote to memory of 588 4040 rundll32.exe 84 PID 4040 wrote to memory of 588 4040 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2644⤵
- Program crash
PID:3496
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 588 -ip 5881⤵PID:1092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5774b9c11bcc0dbf50425e3935100b905
SHA1519338139ca0deaa4b42e056468087e18fd1f253
SHA256be6cab2cfd23bd5cd633264eb9a7d55f0feacda3aff05db031af04a531585590
SHA5126d9a570b441f96013bc5ae2bdc6422beb0f48c3953da00e2443e94de531f8abda9ad8403380543f95e0ac16d84985e1a5829556ff7bf26fca85afbc86fc07872