Overview
overview
10Static
static
10Apache_Ope...es.exe
windows10-ltsc 2021-x64
6$PLUGINSDI...ns.dll
windows10-ltsc 2021-x64
3stat.py
windows10-ltsc 2021-x64
3stats.py
windows10-ltsc 2021-x64
3statvfs.py
windows10-ltsc 2021-x64
3stl_01.ott
windows10-ltsc 2021-x64
3stl_02.ott
windows10-ltsc 2021-x64
3stl_03.ott
windows10-ltsc 2021-x64
3swui.dll
windows10-ltsc 2021-x64
3symbol.py
windows10-ltsc 2021-x64
3symbols.py
windows10-ltsc 2021-x64
3symtable.py
windows10-ltsc 2021-x64
3synchronize.py
windows10-ltsc 2021-x64
3syntax.py
windows10-ltsc 2021-x64
3sysconfig.py
windows10-ltsc 2021-x64
3sysconfig1.py
windows10-ltsc 2021-x64
3sysdtrans.dll
windows10-ltsc 2021-x64
3sysmail.uno.dll
windows10-ltsc 2021-x64
3syssh.uno.dll
windows10-ltsc 2021-x64
3t602filter.dll
windows10-ltsc 2021-x64
3tabbedpages.py
windows10-ltsc 2021-x64
3table.jar
windows10-ltsc 2021-x64
1tabnanny.py
windows10-ltsc 2021-x64
3tarfile.py
windows10-ltsc 2021-x64
3telnetlib.py
windows10-ltsc 2021-x64
3tempfile.py
windows10-ltsc 2021-x64
3textoutstream.uno.dll
windows10-ltsc 2021-x64
3openoffice4115.msi
windows10-ltsc 2021-x64
6readmes/re...s.html
windows10-ltsc 2021-x64
4redist/vcr...64.exe
windows10-ltsc 2021-x64
7redist/vcr...86.exe
windows10-ltsc 2021-x64
7setup.exe
windows10-ltsc 2021-x64
7Analysis
-
max time kernel
423s -
max time network
439s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-es -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows -
submitted
22/01/2025, 15:18
Behavioral task
behavioral1
Sample
Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral3
Sample
stat.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral4
Sample
stats.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral5
Sample
statvfs.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral6
Sample
stl_01.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral7
Sample
stl_02.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral8
Sample
stl_03.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral9
Sample
swui.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral10
Sample
symbol.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral11
Sample
symbols.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral12
Sample
symtable.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral13
Sample
synchronize.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral14
Sample
syntax.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral15
Sample
sysconfig.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral16
Sample
sysconfig1.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral17
Sample
sysdtrans.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral18
Sample
sysmail.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral19
Sample
syssh.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral20
Sample
t602filter.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral21
Sample
tabbedpages.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral22
Sample
table.jar
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral23
Sample
tabnanny.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral24
Sample
tarfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral25
Sample
telnetlib.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral26
Sample
tempfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral27
Sample
textoutstream.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral28
Sample
openoffice4115.msi
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral29
Sample
readmes/readme_es.html
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral30
Sample
redist/vcredist_x64.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral31
Sample
redist/vcredist_x86.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral32
Sample
setup.exe
Resource
win10ltsc2021-20250113-es
General
-
Target
syssh.uno.dll
-
Size
24KB
-
MD5
749c5a95f9fb9a96e7f6b7d3bce8c986
-
SHA1
b6875c9d859f3dd324e3d1d0958ef2d304a932e2
-
SHA256
e1c0ca1cb0223aed6572e54c51dbc561ee957833d4faa61cc56d19316fd04e8b
-
SHA512
e40678b12e467a4b2794355ab837030e314aa434bd883e0f35f3085f86db7fb21bd90b9751ad91134e13e81e1cc3944b288ac549f7f02c06fb84ce3ea9f4575f
-
SSDEEP
384:u9EeXirxVjDblFrO+JCMcE4Nw2cvwfo62OKbggV5ap/orCRL:OE5TjD+My72OKjUor+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4364 wrote to memory of 2068 4364 rundll32.exe 83 PID 4364 wrote to memory of 2068 4364 rundll32.exe 83 PID 4364 wrote to memory of 2068 4364 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\syssh.uno.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\syssh.uno.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2068
-