Overview
overview
10Static
static
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10_converter.dll
windows7-x64
3_converter.dll
windows10-2004-x64
3_docx.dll
windows7-x64
3_docx.dll
windows10-2004-x64
3_freeimage.dll
windows7-x64
3_freeimage.dll
windows10-2004-x64
3_glib.dll
windows7-x64
3_glib.dll
windows10-2004-x64
3_gsf.dll
windows7-x64
3_gsf.dll
windows10-2004-x64
3_myio.dll
windows7-x64
3_myio.dll
windows10-2004-x64
3_ppt.dll
windows7-x64
3_ppt.dll
windows10-2004-x64
3_pptx.dll
windows7-x64
3_pptx.dll
windows10-2004-x64
3_wv2.dll
windows7-x64
3_wv2.dll
windows10-2004-x64
3_xls.dll
windows7-x64
3_xls.dll
windows10-2004-x64
3_xlsx.dll
windows7-x64
3_xlsx.dll
windows10-2004-x64
3_xml2.dll
windows7-x64
3_xml2.dll
windows10-2004-x64
3_zlib.dll
windows7-x64
3_zlib.dll
windows10-2004-x64
3avcodec-57.dll
windows7-x64
3avcodec-57.dll
windows10-2004-x64
3avfilter-6.dll
windows7-x64
3avfilter-6.dll
windows10-2004-x64
3Analysis
-
max time kernel
357s -
max time network
359s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
_converter.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
_converter.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
_docx.dll
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
_docx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
_freeimage.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
_freeimage.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
_glib.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
_glib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
_gsf.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
_gsf.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
_myio.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
_myio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
_ppt.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
_ppt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
_pptx.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
_pptx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
_wv2.dll
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
_wv2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
_xls.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
_xls.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
_xlsx.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
_xlsx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
_xml2.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
_xml2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
_zlib.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
_zlib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
avcodec-57.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
avcodec-57.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
avfilter-6.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
avfilter-6.dll
Resource
win10v2004-20241007-en
General
-
Target
_myio.dll
-
Size
711KB
-
MD5
517840868dc9466c94a1e352d3cd5a21
-
SHA1
5901f5bbb72e7cb6b225b68f7daeef4556fd8454
-
SHA256
c0e001985d9470c6703c92f08a0f46877140e07ff00cef5dcd89c78a2cb8d377
-
SHA512
7ebe5c472c6f62c47a76619c7bf83f64103352115f79496e6b552dd1a1ff6702263cad180c67040c1a1da562060011ddc30f1e9b52c3ee23fa83297382e6e43a
-
SSDEEP
12288:OK5Bf2+ou55C9PpM27PZ1QdczLjsRWl/nC5aEtfiIbpYIH9F/grvVfXnNJgD:Ow5rrCdpXPzUcz2WlW5pYw/grt/e
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2328 1416 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 2244 wrote to memory of 1416 2244 rundll32.exe 31 PID 1416 wrote to memory of 2328 1416 rundll32.exe 32 PID 1416 wrote to memory of 2328 1416 rundll32.exe 32 PID 1416 wrote to memory of 2328 1416 rundll32.exe 32 PID 1416 wrote to memory of 2328 1416 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_myio.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_myio.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 2323⤵
- Program crash
PID:2328
-
-