Analysis

  • max time kernel
    1s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2023 17:48

General

  • Target

    649d1fcdc4529a221d916768edd5108a6a0172ab68fb3068b5248eae7d25143c_JC.dll

  • Size

    144KB

  • MD5

    4e0b43fccdce8ac262a4c760f604a418

  • SHA1

    fcfd2240283547cc436f2c6ee8c0d5c3b33b14bf

  • SHA256

    649d1fcdc4529a221d916768edd5108a6a0172ab68fb3068b5248eae7d25143c

  • SHA512

    25de71118b2d2b6111fc2a06e9b8774a3e8839d6b7f0576ea74377a2dd389a78ba225b4684f85efdd3dd48ce34d866fd38ade33642af6610ea41e3a8312556ea

  • SSDEEP

    1536:NnYwKcxgp81CjMPdrvvXUH4+zNPq7csUEZUWv7EUxV1ZTTbifA47+rjB:NY0o4PRvvz+vV7M

Score
10/10

Malware Config

Signatures

  • Detect magniber ransomware 2 IoCs
  • Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\649d1fcdc4529a221d916768edd5108a6a0172ab68fb3068b5248eae7d25143c_JC.dll,#1
    1⤵
      PID:1464

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1464-0-0x000001F05F630000-0x000001F05F64A000-memory.dmp

      Filesize

      104KB

    • memory/1464-2-0x000001F060EF0000-0x000001F060EF1000-memory.dmp

      Filesize

      4KB

    • memory/1464-4-0x000001F060F20000-0x000001F060F21000-memory.dmp

      Filesize

      4KB

    • memory/1464-7-0x000001F061270000-0x000001F061271000-memory.dmp

      Filesize

      4KB

    • memory/1464-5-0x000001F061260000-0x000001F061261000-memory.dmp

      Filesize

      4KB

    • memory/1464-8-0x000001F061280000-0x000001F061281000-memory.dmp

      Filesize

      4KB

    • memory/2904-1-0x0000028FDF3D0000-0x0000028FDF3DA000-memory.dmp

      Filesize

      40KB

    • memory/2904-12-0x0000028F80010000-0x0000028F80011000-memory.dmp

      Filesize

      4KB