Analysis

  • max time kernel
    96s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 00:04

General

  • Target

    fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll

  • Size

    170KB

  • MD5

    8d1a318e14221eddf86af0c50f6cb8e4

  • SHA1

    162763d9debb02777701acceef260ee7fda347ff

  • SHA256

    fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd

  • SHA512

    18adafb8e7c14b101c7097e67d4c99da25d76a065893be945a81af03092cf025ef4940b21bc95eff7dea4d39dc014de783c30e8604378a56a0727a67ab3c0ce3

  • SSDEEP

    3072:bcwO/iTOdgWtJ6LkHn/rkiENpYrvQaSISixCC/xwp2rrUDf:bDTOdgWtYCjkR/YrvQaSrcwptDf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac24a10c18cd8829429a366297abeb06956fc7dfb308b73fafbc42357adc1bd.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 264
          4⤵
          • Program crash
          PID:3496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 588 -ip 588
    1⤵
      PID:1092

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      134KB

      MD5

      774b9c11bcc0dbf50425e3935100b905

      SHA1

      519338139ca0deaa4b42e056468087e18fd1f253

      SHA256

      be6cab2cfd23bd5cd633264eb9a7d55f0feacda3aff05db031af04a531585590

      SHA512

      6d9a570b441f96013bc5ae2bdc6422beb0f48c3953da00e2443e94de531f8abda9ad8403380543f95e0ac16d84985e1a5829556ff7bf26fca85afbc86fc07872

    • memory/588-10-0x00000000004C0000-0x00000000004C1000-memory.dmp

      Filesize

      4KB

    • memory/588-8-0x0000000000400000-0x0000000000477000-memory.dmp

      Filesize

      476KB

    • memory/4040-0-0x0000000010000000-0x000000001002E000-memory.dmp

      Filesize

      184KB

    • memory/4040-6-0x0000000000C90000-0x0000000000C91000-memory.dmp

      Filesize

      4KB

    • memory/4040-7-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

      Filesize

      4KB

    • memory/4040-9-0x0000000077C52000-0x0000000077C53000-memory.dmp

      Filesize

      4KB

    • memory/4040-5-0x0000000000C80000-0x0000000000C81000-memory.dmp

      Filesize

      4KB

    • memory/4040-12-0x0000000077C52000-0x0000000077C53000-memory.dmp

      Filesize

      4KB