Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
16/12/2024, 12:56
Behavioral task
behavioral1
Sample
socks.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
socks.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target socks.dll
- Size 11KB
- Sample241216-p6ebfa1kc1
- SHA256 2f5e78a842f0e4b9a4851177188d97fe43777962c73eb50c03dc4a9e74b3be60
- MD5 ba11a2315fe2fab73a93f8109c50b423
- SHA1 26cbaf95db474393e81c8189416a7013ced8a046
- SHA512 2e951e962f502f7a07b045ba1e5bea20baca33e87dc83195983843e8c0b223cadc850a74a4d24b0b047f7e144e8f84c79cac883a2634c26ddbf1d8b88794123e
- SSDEEP 192:lNCTnyn4lpuIc7rcWQcp7CkXhrQzpa1u:G7DpuIiHdXua1
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 64 IoCs
flow pid Process 4 1352 rundll32.exe 5 1352 rundll32.exe 6 1352 rundll32.exe 10 1352 rundll32.exe 12 1352 rundll32.exe 13 1352 rundll32.exe 14 1352 rundll32.exe 15 1352 rundll32.exe 16 1352 rundll32.exe 17 1352 rundll32.exe 20 1352 rundll32.exe 23 1352 rundll32.exe 24 1352 rundll32.exe 25 1352 rundll32.exe 26 1352 rundll32.exe 27 1352 rundll32.exe 28 1352 rundll32.exe 31 1352 rundll32.exe 32 1352 rundll32.exe 33 1352 rundll32.exe 34 1352 rundll32.exe 35 1352 rundll32.exe 36 1352 rundll32.exe 37 1352 rundll32.exe 38 1352 rundll32.exe 39 1352 rundll32.exe 40 1352 rundll32.exe 41 1352 rundll32.exe 42 1352 rundll32.exe 43 1352 rundll32.exe 45 1352 rundll32.exe 46 1352 rundll32.exe 47 1352 rundll32.exe 48 1352 rundll32.exe 49 1352 rundll32.exe 50 1352 rundll32.exe 51 1352 rundll32.exe 52 1352 rundll32.exe 53 1352 rundll32.exe 54 1352 rundll32.exe 55 1352 rundll32.exe 56 1352 rundll32.exe 57 1352 rundll32.exe 58 1352 rundll32.exe 59 1352 rundll32.exe 60 1352 rundll32.exe 61 1352 rundll32.exe 62 1352 rundll32.exe 63 1352 rundll32.exe 64 1352 rundll32.exe 65 1352 rundll32.exe 66 1352 rundll32.exe 67 1352 rundll32.exe 68 1352 rundll32.exe 69 1352 rundll32.exe 70 1352 rundll32.exe 71 1352 rundll32.exe 72 1352 rundll32.exe 73 1352 rundll32.exe 74 1352 rundll32.exe 75 1352 rundll32.exe 76 1352 rundll32.exe 77 1352 rundll32.exe 78 1352 rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4668 wrote to memory of 1352 4668 rundll32.exe 83 PID 4668 wrote to memory of 1352 4668 rundll32.exe 83 PID 4668 wrote to memory of 1352 4668 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\socks.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\socks.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1352
-