Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 00:26
Static task
static1
Behavioral task
behavioral1
Sample
ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ad43937eb3ac4cfd6bd460642102eafdd1d2007bdbd369e3db624613284c325c.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/gtlbztpsztf.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/gtlbztpsztf.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/gtlbztpsztf.dll
-
Size
49KB
-
MD5
6432c43cc5cb60bb4a484470e8693ab3
-
SHA1
78f0e1e34dbee0fee48d70949ff07deef94215bc
-
SHA256
e21a1e1f87a1c05b1c97688f72fce20e5f1c42f8579b49d189b3e06f3be8a735
-
SHA512
760c3906675ca690b23e195a7b4c295289dc6242e096ca3140fc199e41474fff7df0500243bde937e4e5ab311d2c4969f02b8b3d87b97bd26d3c3feee5a5ef6e
-
SSDEEP
768:M57MzH3v2IihsP+l1nrk2IJ1/95UrpRxKZfUJXeykaxLT+QZv6qCGb:M57ohP+l1rktZ5qpWZf0XeyVxDd6/Gb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1464 216 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3012 wrote to memory of 216 3012 rundll32.exe 83 PID 3012 wrote to memory of 216 3012 rundll32.exe 83 PID 3012 wrote to memory of 216 3012 rundll32.exe 83 PID 216 wrote to memory of 3352 216 rundll32.exe 84 PID 216 wrote to memory of 3352 216 rundll32.exe 84 PID 216 wrote to memory of 3352 216 rundll32.exe 84 PID 216 wrote to memory of 3352 216 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gtlbztpsztf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gtlbztpsztf.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gtlbztpsztf.dll,#13⤵PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 7523⤵
- Program crash
PID:1464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 216 -ip 2161⤵PID:8