Overview
overview
10Static
static
54369a932cc...ca.exe
windows7-x64
104369a932cc...ca.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$TEMP/gtalkwmp1.dll
windows7-x64
3$TEMP/gtalkwmp1.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 11:26
Behavioral task
behavioral1
Sample
4369a932cc794beb24a7cb49607d29e00da918be302bf67d2c8fce7f02635bca.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4369a932cc794beb24a7cb49607d29e00da918be302bf67d2c8fce7f02635bca.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$TEMP/gtalkwmp1.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$TEMP/gtalkwmp1.dll
Resource
win10v2004-20241007-en
General
-
Target
$TEMP/gtalkwmp1.dll
-
Size
68KB
-
MD5
f341a096bbc785dc39e0170ff725a7d5
-
SHA1
75b233a2fc20ff4a748c65b80c17188f63b9cd53
-
SHA256
fd23273a36db53e1da88e2b4ec84ffb720e54f9c6ab8820bf8937e870d64e44b
-
SHA512
fe4a237a9b7b100e0b4ae5a2daf30989b3d6744ee7e7ba0a8a3c6322cf390a93fde3cfed79e4593e06f7ff072e1c207b9182623ccdb1b9da02cb412c8096b77a
-
SSDEEP
1536:tEAx/fgfg9yE7qnuhyP27auArvBMJlFf:tDxBZqV2evBMJlF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82ec66ad-6a51-4aa5-8788-dea156a4580b}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$TEMP\\gtalkwmp1.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82ec66ad-6a51-4aa5-8788-dea156a4580b}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82ec66ad-6a51-4aa5-8788-dea156a4580b} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82ec66ad-6a51-4aa5-8788-dea156a4580b}\ = "Google Talk Music Plugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82ec66ad-6a51-4aa5-8788-dea156a4580b}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30 PID 1908 wrote to memory of 1692 1908 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\gtalkwmp1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$TEMP\gtalkwmp1.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1692
-