Overview

overview

8

Static

static

b03623e481...74.dll

windows7-x64

8

b03623e481...74.dll

windows10-2004-x64

8

Analysis

  • max time kernel
    240s
  • max time network
    196s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 03:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b03623e4818e60869f67dba28ab09187782a4ae0f4539cef2c07634865f37e74.dll

  • Size

    240KB

  • MD5

    dbc7e219e9af297271ea594f0ff6ad12

  • SHA1

    040069e5ecf1110f6634961b349938682fee2a22

  • SHA256

    b03623e4818e60869f67dba28ab09187782a4ae0f4539cef2c07634865f37e74

  • SHA512

    7d6073c083236e2c31bf1d14d4baaa92ae68133be19f5736ec07bb1b17efb01ceadb15d2ac22ed9ca70b05be06f22da649a882b7da0a2bc11da0779e0629d92a

  • SSDEEP

    3072:U6BY2LT+MAAKxrYzaR8Yun8ZzTVedcn9V:pY2LTpAazaRLaodDV

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b03623e4818e60869f67dba28ab09187782a4ae0f4539cef2c07634865f37e74.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\seccenter.xxx
      C:\Users\Admin\AppData\Local\Temp\seccenter.xxx
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:660

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\seccenter.xxx
    Filesize

    85KB

    MD5

    d399e5b8d0d6a01e14e713488d1ee6d9

    SHA1

    ce54a99d0a29c945958228ae7d755519dee88c11

    SHA256

    40933d429fad3375721d4374939e3bf0d79390e47709207cb2a0848f01670cf7

    SHA512

    c79f122577c7b626aafc03dc55a637a5664dd5064046ea98430ffd2ef6c523fbc7e80cd4fe3bce8dc837d2d827e19ae01a8092cca1fc209ed947815a9841489f

    Download Submit

  • \??\c:\users\admin\appdata\local\temp\seccenter.xxx
    Filesize

    85KB

    MD5

    d399e5b8d0d6a01e14e713488d1ee6d9

    SHA1

    ce54a99d0a29c945958228ae7d755519dee88c11

    SHA256

    40933d429fad3375721d4374939e3bf0d79390e47709207cb2a0848f01670cf7

    SHA512

    c79f122577c7b626aafc03dc55a637a5664dd5064046ea98430ffd2ef6c523fbc7e80cd4fe3bce8dc837d2d827e19ae01a8092cca1fc209ed947815a9841489f

    Download Submit

  • memory/660-56-0x0000000010000000-0x000000001000A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/660-60-0x00000000003C0000-0x00000000003CA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/660-63-0x0000000000340000-0x000000000034B000-memory.dmp

    Filesize

    44KB

    Download