Overview
overview
10Static
static
10intro.exe
windows7-x64
1intro.exe
windows10-2004-x64
3keygen-pr.exe
windows7-x64
3keygen-pr.exe
windows10-2004-x64
3keygen-step-1.exe
windows7-x64
10keygen-step-1.exe
windows10-2004-x64
10keygen-step-3.exe
windows7-x64
3keygen-step-3.exe
windows10-2004-x64
3keygen-step-4.exe
windows7-x64
10keygen-step-4.exe
windows10-2004-x64
10keygen.bat
windows7-x64
10keygen.bat
windows10-2004-x64
10user32.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 20:33
Behavioral task
behavioral1
Sample
intro.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
intro.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
keygen-pr.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
keygen-pr.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
keygen-step-1.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
keygen-step-1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
keygen-step-3.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
keygen-step-3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
keygen-step-4.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
keygen-step-4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
keygen.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
keygen.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
user32.dll
Resource
win10v2004-20241007-en
General
-
Target
user32.dll
-
Size
1.6MB
-
MD5
634fbe95ea4ef2e799b3d117dd9ec52e
-
SHA1
09533551abefbc922b87d1c2553329abd328c387
-
SHA256
1ba4bc4f000dd9263307357ffa42d83eb01f59bf28aec16ef2eb74e24683412e
-
SHA512
7d3857623c2d6806ed56e436fba2aa72ee57978ed8261894c3d7bb97a9f747d87866ca1dfaa2bc21ea22de1544fe7daf223565b7f16d894d02219ea9a690b7cf
-
SSDEEP
24576:77hFCFHT0vzImKVsVzuJJBwuCx59U4IgL5pz1:P6STzwJBwuOTU4Ia1
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3976 wrote to memory of 3608 3976 rundll32.exe 82 PID 3976 wrote to memory of 3608 3976 rundll32.exe 82 PID 3976 wrote to memory of 3608 3976 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\user32.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3608
-