Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 16:46
Behavioral task
behavioral1
Sample
b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03.dll
-
Size
568KB
-
MD5
5de2e3364f14ea8005eb79a9ccf4abf4
-
SHA1
6820bc1deab231e58c8210de9c72bf29a70d60c4
-
SHA256
b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03
-
SHA512
a59f887a62274f465157fd5c20940d453caa42f3faedda6daf2facc73eb39495e3e904ac595494faf9cdbf8421552a68ba16c9b7b9dfc74de5ec03af2df24d56
-
SSDEEP
12288:nE+xtRkFD3VOyvXHl4V06VTNcWCFzN+s61SHvFqpkGcS+Th77:nE+xtRED3Vd4V06FLCF8+hQoh7
Malware Config
Signatures
-
Blocklisted process makes network request 56 IoCs
flow pid Process 3 2812 rundll32.exe 4 2812 rundll32.exe 5 2812 rundll32.exe 6 2812 rundll32.exe 7 2812 rundll32.exe 8 2812 rundll32.exe 9 2812 rundll32.exe 10 2812 rundll32.exe 11 2812 rundll32.exe 12 2812 rundll32.exe 13 2812 rundll32.exe 14 2812 rundll32.exe 15 2812 rundll32.exe 16 2812 rundll32.exe 17 2812 rundll32.exe 18 2812 rundll32.exe 19 2812 rundll32.exe 20 2812 rundll32.exe 21 2812 rundll32.exe 22 2812 rundll32.exe 23 2812 rundll32.exe 24 2812 rundll32.exe 25 2812 rundll32.exe 26 2812 rundll32.exe 27 2812 rundll32.exe 28 2812 rundll32.exe 29 2812 rundll32.exe 30 2812 rundll32.exe 31 2812 rundll32.exe 32 2812 rundll32.exe 33 2812 rundll32.exe 34 2812 rundll32.exe 35 2812 rundll32.exe 36 2812 rundll32.exe 37 2812 rundll32.exe 38 2812 rundll32.exe 40 2812 rundll32.exe 41 2812 rundll32.exe 42 2812 rundll32.exe 43 2812 rundll32.exe 44 2812 rundll32.exe 45 2812 rundll32.exe 46 2812 rundll32.exe 47 2812 rundll32.exe 49 2812 rundll32.exe 50 2812 rundll32.exe 51 2812 rundll32.exe 52 2812 rundll32.exe 53 2812 rundll32.exe 54 2812 rundll32.exe 55 2812 rundll32.exe 56 2812 rundll32.exe 57 2812 rundll32.exe 58 2812 rundll32.exe 59 2812 rundll32.exe 60 2812 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30 PID 2704 wrote to memory of 2812 2704 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b131b84985376e265d3331860b0c36432ef06e2123cfa16a7daa08fae16d03.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2812
-