Overview
overview
10Static
static
3FNP_Act_Installer.dll
windows7-x64
3FNP_Act_Installer.dll
windows10-2004-x64
3ISUIServices.dll
windows7-x64
3ISUIServices.dll
windows10-2004-x64
3MSIMG32.dll
windows7-x64
3MSIMG32.dll
windows10-2004-x64
3TSConfig.exe
windows7-x64
3TSConfig.exe
windows10-2004-x64
10ToolkitPro...0U.dll
windows7-x64
3ToolkitPro...0U.dll
windows10-2004-x64
3mfc140u.dll
windows7-x64
3mfc140u.dll
windows10-2004-x64
3msvcp140.dll
windows7-x64
3msvcp140.dll
windows10-2004-x64
3vcruntime140.dll
windows7-x64
3vcruntime140.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 20:47 UTC
Static task
static1
Behavioral task
behavioral1
Sample
FNP_Act_Installer.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
FNP_Act_Installer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ISUIServices.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
ISUIServices.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
MSIMG32.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
MSIMG32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
TSConfig.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
TSConfig.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ToolkitPro2200vc170U.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
ToolkitPro2200vc170U.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
mfc140u.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
mfc140u.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
msvcp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
msvcp140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
vcruntime140.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
vcruntime140.dll
Resource
win10v2004-20241007-en
General
-
Target
ISUIServices.dll
-
Size
7.7MB
-
MD5
3b81ed520d9dde9c78a9aa9ec5bcc205
-
SHA1
25a9730125f20232bebd09bf17c224647a04dce9
-
SHA256
276f328fdf9df6c5094bee29f10576bbb3b78dc853fb4cd344038ed857099dbd
-
SHA512
1a2cbfd7c422428dcd2ff7ed684c52abfb307f61ebdfaf64bdcddbfa36ef97092c6e52b9c9ec0c001ab5d6f7b92453b7099499ace333530b414a8a6ccf221bb5
-
SSDEEP
49152:+QE4Ba3fv8197MXdbYr3dYvGOnCCztpEuDBVhahN4kejo1gN8o5BzPOLP:+d4Buv81975pYQhuDBEOE
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4920 4840 regsvr32.exe 84 PID 4840 wrote to memory of 4920 4840 regsvr32.exe 84 PID 4840 wrote to memory of 4920 4840 regsvr32.exe 84
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request85.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request22.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request22.49.80.91.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request252.15.104.51.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
85.49.80.91.in-addr.arpa
-
146 B 139 B 2 1
DNS Request
167.173.78.104.in-addr.arpa
DNS Request
167.173.78.104.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
107.12.20.2.in-addr.arpa
-
140 B 145 B 2 1
DNS Request
22.49.80.91.in-addr.arpa
DNS Request
22.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
252.15.104.51.in-addr.arpa