Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 09:44
Behavioral task
behavioral1
Sample
882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fcN.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fcN.dll
Resource
win10v2004-20241007-en
General
-
Target
882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fcN.dll
-
Size
135KB
-
MD5
651a0b77d52e0ec261ed7ad34369a210
-
SHA1
817136ac3da1035177b4442eadd5e5f665982716
-
SHA256
882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fc
-
SHA512
105723a1a56784245afffa1bb8a16f8049635bfc4be965c53ea87eef8fcd69b8aac160406fecae72ce8feb843a9e3650256e13601e4d2a2d7649b36dc873a25a
-
SSDEEP
3072:81AaJomSE8ibVRWKpyaZH35mLTi8Mir3m3aWQXZ6Yfd/TTai8/:8qmSE8iJEKpyo5ATEir3KaVXZ6+Vv8/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid Process procid_target PID 1620 wrote to memory of 1444 1620 regsvr32.exe 82 PID 1620 wrote to memory of 1444 1620 regsvr32.exe 82 PID 1620 wrote to memory of 1444 1620 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fcN.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\882fc5b5f547eb42507d7a21a39f93b7efa0793846c63d044dd6e933406625fcN.dll2⤵
- System Location Discovery: System Language Discovery
PID:1444
-