Analysis
-
max time kernel
0s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-12-2023 10:15
General
-
Target
adcd96c04e6729479b71004ec131f43e.dll
-
Size
38KB
-
MD5
adcd96c04e6729479b71004ec131f43e
-
SHA1
08699a15fec12a40a1aab8cf8073c0fc4629ecfb
-
SHA256
598e6aa444a25c2442e321af24044fbfbf22a68843586cf058c29d5ac2b48461
-
SHA512
2400e0246eb653d254724e539b53bedc1e0817c61d23a58d9ca72c22ce4e71c480d92462dae06af8a8626d9e49a73f458a74c3aac10a735263ea11ba3c754985
-
SSDEEP
768:40PNWfnUqS31SdW3ZM0twjSamZjDrUim1hC3WpkqJNAhMO5zFtcAK72Rcv:4wemSdW3ZM0tc6jDw145mNAh95RtcAKa
Score
10/10
Malware Config
Signatures
-
Detect magniber ransomware 1 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adcd96c04e6729479b71004ec131f43e.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB