Overview
overview
10Static
static
7All-In-One.exe
windows7-x64
10All-In-One.exe
windows10-2004-x64
10External/C...r4.dll
windows7-x64
5External/C...r4.dll
windows10-2004-x64
5External/C...s3.dll
windows7-x64
7External/C...s3.dll
windows10-2004-x64
7External/C...c4.dll
windows7-x64
5External/C...c4.dll
windows10-2004-x64
5External/C...s4.dll
windows7-x64
7External/C...s4.dll
windows10-2004-x64
7External/C...n3.dll
windows7-x64
7External/C...n3.dll
windows10-2004-x64
7External/C...ot.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...-0.dll
windows10-2004-x64
3External/C...l3.dll
windows7-x64
3External/C...l3.dll
windows10-2004-x64
3External/C...ue.dll
windows7-x64
3External/C...ue.dll
windows10-2004-x64
3External/C...40.dll
windows7-x64
3External/C...40.dll
windows10-2004-x64
3External/C...s3.dll
windows7-x64
3Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 12:16
Behavioral task
behavioral1
Sample
All-In-One.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
All-In-One.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
External/Components/nspr4.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
External/Components/nspr4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
External/Components/nss3.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
External/Components/nss3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
External/Components/plc4.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
External/Components/plc4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
External/Components/plds4.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
External/Components/plds4.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
External/Components/softokn3.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
External/Components/softokn3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
External/ComponentsExt/api-ms-win-crt-conio-l1-1-0_not.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
External/ComponentsExt/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
External/ComponentsExt/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
External/ComponentsExt/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
External/ComponentsExt/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
External/ComponentsExt/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
External/ComponentsExt/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
External/ComponentsExt/api-ms-win-crt-multibyte-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
External/ComponentsExt/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
External/ComponentsExt/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
External/ComponentsExt/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
External/ComponentsExt/api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
External/ComponentsExt/api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
External/ComponentsExt/freebl3.dll
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
External/ComponentsExt/freebl3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
External/ComponentsExt/mozglue.dll
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
External/ComponentsExt/mozglue.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
External/ComponentsExt/msvcp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
External/ComponentsExt/msvcp140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
External/ComponentsExt/nss3.dll
Resource
win7-20240903-en
General
-
Target
External/ComponentsExt/freebl3.dll
-
Size
324KB
-
MD5
04a2ba08eb17206b7426cb941f39250b
-
SHA1
731ac2b533724d9f540759d84b3e36910278edba
-
SHA256
8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4
-
SHA512
e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc
-
SSDEEP
6144:c+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XPVjN:cu4Abg7XV72GI/qn6T
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30 PID 1580 wrote to memory of 2732 1580 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2732
-