Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 07:01
Static task
static1
Behavioral task
behavioral1
Sample
e2af923eb604287686987c977bd5b7d85354377ca74c5a002206b647e0738143.dll
Resource
win7-20240903-en
General
-
Target
e2af923eb604287686987c977bd5b7d85354377ca74c5a002206b647e0738143.dll
-
Size
188KB
-
MD5
2828a5c5917e4e8b36da55dc303ab752
-
SHA1
983ae161d008475fc2d1510bd2ce75e5ad6e9ed5
-
SHA256
e2af923eb604287686987c977bd5b7d85354377ca74c5a002206b647e0738143
-
SHA512
cbde1292d66936ad79b89893343417828e45943c22eb04a595dc7c467ca563cb3e4f2f1084cff23b79c9b23c2dd548bab9ab3b8856acc59024e1aacee83c1bc0
-
SSDEEP
3072:wkk/wxp+etRwew56OxxejSGuBoBp2QzrZHBMtYsIrfy9Qm:zDHA6dj1BrZHutWrfE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2708 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 2600 rundll32.exe 2600 rundll32.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe 1588 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1588 2708 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 1868 wrote to memory of 2600 1868 rundll32.exe 30 PID 2600 wrote to memory of 2708 2600 rundll32.exe 31 PID 2600 wrote to memory of 2708 2600 rundll32.exe 31 PID 2600 wrote to memory of 2708 2600 rundll32.exe 31 PID 2600 wrote to memory of 2708 2600 rundll32.exe 31 PID 2708 wrote to memory of 1588 2708 rundll32mgr.exe 32 PID 2708 wrote to memory of 1588 2708 rundll32mgr.exe 32 PID 2708 wrote to memory of 1588 2708 rundll32mgr.exe 32 PID 2708 wrote to memory of 1588 2708 rundll32mgr.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2af923eb604287686987c977bd5b7d85354377ca74c5a002206b647e0738143.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2af923eb604287686987c977bd5b7d85354377ca74c5a002206b647e0738143.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1564⤵
- Loads dropped DLL
- Program crash
PID:1588
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350