Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 18:28
Behavioral task
behavioral1
Sample
b21a4692deaab31b04b7fb67bb67ddb956353c157b8ffc99c6b2f75cd4ae5983.dll
Resource
win7-20241023-en
5 signatures
150 seconds
General
-
Target
b21a4692deaab31b04b7fb67bb67ddb956353c157b8ffc99c6b2f75cd4ae5983.dll
-
Size
76KB
-
MD5
b2518b174ef418b4bac69302614759cb
-
SHA1
fd179822ad6b5601658185b12608c234f28a961d
-
SHA256
b21a4692deaab31b04b7fb67bb67ddb956353c157b8ffc99c6b2f75cd4ae5983
-
SHA512
2c12a8e25452992494d6e92228e6aee4319038a2ec3b4bea202348d2e629b75d26426036f44460209a008c47f1caab40da0c7564eec247fee2c32d1dc18dc9fc
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zt/j8nw:c8y93KQjy7G55riF1cMo03Z
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2916-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2916-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2916 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2916 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30 PID 2932 wrote to memory of 2916 2932 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b21a4692deaab31b04b7fb67bb67ddb956353c157b8ffc99c6b2f75cd4ae5983.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b21a4692deaab31b04b7fb67bb67ddb956353c157b8ffc99c6b2f75cd4ae5983.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-