683ca425f41a71de907a7203e850eaf6a171a7b53982c7a1c7a7129de4b09c8b

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

683ca425f41a71de907a7203e850eaf6a171a7b53982c7a1c7a7129de4b09c8b.dll
Size

444KB
MD5

42ed7465e999692d58bd4fb253c70903
SHA1

e112f2b6055aead172d349971384cfcab9c28276
SHA256

683ca425f41a71de907a7203e850eaf6a171a7b53982c7a1c7a7129de4b09c8b
SHA512

526f053cac120d71a10f96405b231b39ef3c7f09af3de468bec6ba016e5462b564d86037df8ae112a80fa33be6189c23dbcbd99435c41eb2247f656061d030d0
SSDEEP

12288:KXo450qjYthuCNIm/kqF6a2FjyHIDiAstWeO5xzb6A:7/ku6FjyHe5KOP/x

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1532	rundll32Srv.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023b6d-2.dat	upx
behavioral2/memory/1532-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1516	1532	WerFault.exe	84
1416	2500	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2500	4396	rundll32.exe	83
PID 4396 wrote to memory of 2500	4396	rundll32.exe	83
PID 4396 wrote to memory of 2500	4396	rundll32.exe	83
PID 2500 wrote to memory of 1532	2500	rundll32.exe	84
PID 2500 wrote to memory of 1532	2500	rundll32.exe	84
PID 2500 wrote to memory of 1532	2500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\683ca425f41a71de907a7203e850eaf6a171a7b53982c7a1c7a7129de4b09c8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\683ca425f41a71de907a7203e850eaf6a171a7b53982c7a1c7a7129de4b09c8b.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 268
      4⤵
      Program crash
      PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 696
    3⤵
    - Program crash
    PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2500 -ip 2500
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1532 -ip 1532
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
67KB

MD5
ce9076b388d0d859a1dbedb92c00f876

SHA1
0f1a621d667f851a81c25f1adba89f3872ac6eeb

SHA256
32c21048d6c384be965ca83d554fb142ea0ca798cc1a552f8e800e75aae142f6

SHA512
f52a96c155047fb4cea09f8c6d44db8e0bb267c7829812eefe126d787f3197ed27f45d48eff440d8f9dacf71cd518667064f59bf334f2c871f88354ca60ad293

Download Submit
memory/1532-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1532-5-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2500-4-0x0000000010000000-0x00000000126A7000-memory.dmp

Filesize
38.7MB

Download
memory/2500-8-0x0000000010000000-0x00000000126A7000-memory.dmp

Filesize
38.7MB

Download