0be35975a9936bc239c69fb4c6e123f1b9f8b20c469d7fc38c62ae41fbde017b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/carts/u2l2000.dll
Size

22KB
MD5

6ec4efacbc97780df137830a7048eb84
SHA1

42baf27afbed37494c6dec64397bee989bee346b
SHA256

2dca9c28a3a056bf5a851bc0715da8f794a2c5663c2a55290fe802fb67eebf2a
SHA512

8a4951d17858b043ec279a322d54fa759f58e05237865ca7c7d93a60e253f2d7183d35581934561044a2b23b9aec64bb3bb3f9ec9977224c1621eccf75302475
SSDEEP

384:5w2rZdfNO4Pdc1YUo21/ar7jCDS+/hLCcY9jBJJ1lqI:5w27iSr747pL38TJ1lqI

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2280	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2408 wrote to memory of 2280	2408	rundll32.exe	31
PID 2280 wrote to memory of 2172	2280	rundll32.exe	32
PID 2280 wrote to memory of 2172	2280	rundll32.exe	32
PID 2280 wrote to memory of 2172	2280	rundll32.exe	32
PID 2280 wrote to memory of 2172	2280	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\carts\u2l2000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\carts\u2l2000.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 228
    3⤵
    - Program crash
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads