Overview
overview
10Static
static
1yyy.zip
windows10-ltsc 2021-x64
1HTCTL32.dll
windows10-ltsc 2021-x64
3Logo.png
windows10-ltsc 2021-x64
7LogoBeta.png
windows10-ltsc 2021-x64
7LogoCanary.png
windows10-ltsc 2021-x64
7LogoDev.png
windows10-ltsc 2021-x64
7NSM.lic
windows10-ltsc 2021-x64
3NSM.ini
windows10-ltsc 2021-x64
1PCICHEK.dll
windows10-ltsc 2021-x64
3PCICL32.dll
windows10-ltsc 2021-x64
3TCCTL32.dll
windows10-ltsc 2021-x64
3cAlient32.ini
windows10-ltsc 2021-x64
1client32.exe
windows10-ltsc 2021-x64
10client32.ini
windows10-ltsc 2021-x64
1ie_to_edge_bho.dll
windows10-ltsc 2021-x64
3ie_to_edge_bho_64.dll
windows10-ltsc 2021-x64
1install_state.json
windows10-ltsc 2021-x64
3msvcr100.dll
windows10-ltsc 2021-x64
3nskbfltr.inf
windows10-ltsc 2021-x64
1nsm_vpro.ini
windows10-ltsc 2021-x64
1pcicapi.dll
windows10-ltsc 2021-x64
3remcmdstub.exe
windows10-ltsc 2021-x64
3temp/5B8FE...7493Es
windows10-ltsc 2021-x64
1temp/5F301...103ABs
windows10-ltsc 2021-x64
1temp/6D746...21E0Fs
windows10-ltsc 2021-x64
1temp/8C071...720F3s
windows10-ltsc 2021-x64
1temp/quit_2.ico
windows10-ltsc 2021-x64
3Resubmissions
04-12-2024 04:28
241204-e3ta3sxlep 104-12-2024 03:02
241204-djgmhatpdm 104-12-2024 02:46
241204-c9ep6axpg1 10Analysis
-
max time kernel
98s -
max time network
140s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
04-12-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
yyy.zip
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
Logo.png
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
LogoBeta.png
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
LogoCanary.png
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
LogoDev.png
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
NSM.lic
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
NSM.ini
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
PCICHEK.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
PCICL32.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
TCCTL32.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral12
Sample
cAlient32.ini
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral13
Sample
client32.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral14
Sample
client32.ini
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral15
Sample
ie_to_edge_bho.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral16
Sample
ie_to_edge_bho_64.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral17
Sample
install_state.json
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral18
Sample
msvcr100.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral19
Sample
nskbfltr.inf
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral20
Sample
nsm_vpro.ini
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral21
Sample
pcicapi.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral22
Sample
remcmdstub.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral23
Sample
temp/5B8FEB2AF817493Es
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral24
Sample
temp/5F3010ACA99103ABs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral25
Sample
temp/6D746DDFF1121E0Fs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral26
Sample
temp/8C071BA874B720F3s
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral27
Sample
temp/quit_2.ico
Resource
win10ltsc2021-20241023-en
General
-
Target
PCICHEK.dll
-
Size
18KB
-
MD5
104b30fef04433a2d2fd1d5f99f179fe
-
SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41
-
SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
-
SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
SSDEEP
192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2984 wrote to memory of 5060 2984 rundll32.exe 80 PID 2984 wrote to memory of 5060 2984 rundll32.exe 80 PID 2984 wrote to memory of 5060 2984 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICHEK.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICHEK.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5060
-