Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 11:39
Static task
static1
Behavioral task
behavioral1
Sample
eb5b30e2ea10adb6b2ae9cacf69f4a1638e508cff9b434ae679997f2c8501953N.dll
Resource
win7-20240729-en
General
-
Target
eb5b30e2ea10adb6b2ae9cacf69f4a1638e508cff9b434ae679997f2c8501953N.dll
-
Size
165KB
-
MD5
dca6f758c8516f58798fe5dd8db34800
-
SHA1
3d9f9977b58f44da49aaf9d01694194ce81f924f
-
SHA256
eb5b30e2ea10adb6b2ae9cacf69f4a1638e508cff9b434ae679997f2c8501953
-
SHA512
273c1866a09df4c112219af2025294a7e8be9de5b93fdfb0038427b2cc1150238500e846445d765a54ecee9338a5e5d697b8f3bd61d574f532da6c3acbc9c117
-
SSDEEP
3072:BsLXHHf0z4o++2dLy2aOtusyu/T3EcdDZBzgdPrNO/BQGmWsdgGal4:BUPy3Ot7br0cdXgBNO/Cjva+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3372 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000d000000023b80-3.dat upx behavioral2/memory/3372-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3372-7-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 824 3372 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4016 wrote to memory of 4656 4016 rundll32.exe 82 PID 4016 wrote to memory of 4656 4016 rundll32.exe 82 PID 4016 wrote to memory of 4656 4016 rundll32.exe 82 PID 4656 wrote to memory of 3372 4656 rundll32.exe 83 PID 4656 wrote to memory of 3372 4656 rundll32.exe 83 PID 4656 wrote to memory of 3372 4656 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb5b30e2ea10adb6b2ae9cacf69f4a1638e508cff9b434ae679997f2c8501953N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb5b30e2ea10adb6b2ae9cacf69f4a1638e508cff9b434ae679997f2c8501953N.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 2644⤵
- Program crash
PID:824
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3372 -ip 33721⤵PID:4256
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5b8e6f2753e6d6063d2ddbe2d0646da3a
SHA15ea3ef8fe2bde63b4489417a38985adaf2598ae2
SHA256a2857d0f4628b42aa99a81cc1aeb7c9c14c5913c9c18f180aaae06a9ea979c12
SHA5122a9069f8e2925ebc275f09c374b916d3917d6224f55345feb07a2424fc9764b49b5ef3d6ea4558e81d657dbe625c1622fd34041102ad1171901378548513a060