Overview
overview
5Static
static
5LegacyUpda...11.exe
windows10-2004-x64
5LegacyUpda...11.exe
windows11-21h2-x64
5$PLUGINSDI...IS.dll
windows10-2004-x64
3$PLUGINSDI...IS.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LegacyUpdate.dll
windows10-2004-x64
3LegacyUpdate.dll
windows11-21h2-x64
3Analysis
-
max time kernel
101s -
max time network
111s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2025, 18:13
Behavioral task
behavioral1
Sample
LegacyUpdate-1.111.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
LegacyUpdate-1.111.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LegacyUpdateNSIS.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LegacyUpdateNSIS.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSxfer.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSxfer.dll
Resource
win11-20250502-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250610-en
Behavioral task
behavioral9
Sample
LegacyUpdate.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral10
Sample
LegacyUpdate.dll
Resource
win11-20250619-en
General
-
Target
$PLUGINSDIR/NSxfer.dll
-
Size
79KB
-
MD5
f15486d7a79483fdde18e593c23e9c11
-
SHA1
7563728e17a9165af5c3665d37165f26db9fad7a
-
SHA256
d9fd2daa076ccc15154d655c1233d978bb5ae6a0381fe212c0dabd7b8c889cad
-
SHA512
7bac21643b4db26e5fcd3bef83e72fecc420776093b0a323da60da870bcef8ba9ff527e0c84494a6d14ddcf5d817513a652dc48cc34c7d03b088146c74519450
-
SSDEEP
1536:w43Oi3NhhhLnHYgyFPDVLNCtmDg2L7SR8mng2L7Sj:vOizhV4gyFPDVLNSCZfSR8GZfSj
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4576 3568 WerFault.exe 78 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3568 3868 rundll32.exe 78 PID 3868 wrote to memory of 3568 3868 rundll32.exe 78 PID 3868 wrote to memory of 3568 3868 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSxfer.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSxfer.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 5363⤵
- Program crash
PID:4576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3568 -ip 35681⤵PID:2040