be45d7138d4f616cd7f3ac7cbe6d96850b5189ce2d03e859297488afeabd1ba8

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be45d7138d4f616cd7f3ac7cbe6d96850b5189ce2d03e859297488afeabd1ba8.dll
Size

4.6MB
MD5

2ab8971d76a82f8cecc3572cfca78371
SHA1

1b21737698036314fdb9c9d4516123d3c8d2c384
SHA256

be45d7138d4f616cd7f3ac7cbe6d96850b5189ce2d03e859297488afeabd1ba8
SHA512

1cf3b7093851abcd4a07ac3160e545398a632995976c1aa243db6c97878eb71d5b2c561523ae3b863b54795764eb97f63a5046186140f92ac87ae3d966e6f80e
SSDEEP

49152:UvbJ6qfDUSSOA0Dbuqokdfelt2okynejEwblH5lLLkhZVYa:UvPfDUSSOAcilltnleIqlr4hZVYa

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3036	rundll32.exe
3036	rundll32.exe
3036	rundll32.exe
3036	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2316	2272	rundll32.exe	30
PID 2272 wrote to memory of 2316	2272	rundll32.exe	30
PID 2272 wrote to memory of 2316	2272	rundll32.exe	30
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31
PID 2316 wrote to memory of 3036	2316	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be45d7138d4f616cd7f3ac7cbe6d96850b5189ce2d03e859297488afeabd1ba8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Roaming\USERENV.dll,SLClose
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Roaming\USERENV.dll,SLClose
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\USERENV.dll

Filesize
2.4MB

MD5
45a0d692a2cd42035cd6c5b6ade02082

SHA1
a6e3f8801107b60e4a24ac5adf84a6a082ffae76

SHA256
568d658c0043c35374c066ba7e50d8ba603e8077610cf617d63566084e0bd334

SHA512
0e01d11ff0bc20cc295c72db5b9ec8fd4b18f0d9ed1231e6097932a467bd8dc9da620a2abdbe922aa18e2665350c3a8c6f8793936b143e68b56569840e366d89

Download Submit
memory/3036-6-0x0000000074820000-0x00000000749CD000-memory.dmp

Filesize
1.7MB

Download