Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 12:14
Behavioral task
behavioral1
Sample
f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63.dll
Resource
win10v2004-20241007-en
General
-
Target
f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63.dll
-
Size
1.2MB
-
MD5
4a2579809a60dafdd9da2c50484e8735
-
SHA1
d3e1c79b5b5d7ab8ff2313d7696998527a3f5bd1
-
SHA256
f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63
-
SHA512
2af6ee811093ae53ec4d9358d44a5d6fbc32a85b509502010490c4eb324dd22cc659478ea2d39aa37b70dac71ca9544e427acd440f4ff1024bf0557ec0c666ff
-
SSDEEP
24576:LohYJJUEWaGjGM7hiBrDaFy73fChNqhXWSNNmbCTM5GrkQPXHMtR1tD1b1tTkRoN:Lorx7TkQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1656 2460 rundll32.exe 84 PID 2460 wrote to memory of 1656 2460 rundll32.exe 84 PID 2460 wrote to memory of 1656 2460 rundll32.exe 84 PID 1656 wrote to memory of 1648 1656 rundll32.exe 85 PID 1656 wrote to memory of 1648 1656 rundll32.exe 85 PID 1656 wrote to memory of 1648 1656 rundll32.exe 85 PID 1656 wrote to memory of 1588 1656 rundll32.exe 86 PID 1656 wrote to memory of 1588 1656 rundll32.exe 86 PID 1656 wrote to memory of 1588 1656 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f036b3031238597750e077c2d03b2bc41d089f9db461244059db8485fac28e63.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.execmd /c md C:\Users\Public\Documents\MM3⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
C:\Windows\SysWOW64\cmd.execmd /c md C:\Users\Public\Documents\MM3⤵
- System Location Discovery: System Language Discovery
PID:1588
-
-