Overview

overview

7

Static

static

3

0797ffd75b...8a.exe

windows7-x64

7

0797ffd75b...8a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    154s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 23:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0797ffd75becc7abb93890250ddf628a.exe

  • Size

    104KB

  • MD5

    0797ffd75becc7abb93890250ddf628a

  • SHA1

    ecd9c3414e81c0d9ad2c97314882df0930b1c747

  • SHA256

    5a84733effda557b885370801bd0d46f573424e2ff7983e3feb385725770755f

  • SHA512

    4f15e1c964fbdc734c6f899d73017d66ff11f83f80088add2db087da897902151a8a61042a1f54f01c6bb2343645f853fc4a6b1b07a5f50343172fe7cd249a4a

  • SSDEEP

    1536:ZAqlTmQYY46Jkvl0Kqdw/X2INaib+XkbkyaS1pDoyTrH4JmWW7:WkdK95qoGOKXoau8MrHv

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0797ffd75becc7abb93890250ddf628a.exe
    "C:\Users\Admin\AppData\Local\Temp\0797ffd75becc7abb93890250ddf628a.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Windows\SysWOW64\mscccdj32.dll
      C:\Windows\system32\mscccdj32.dll fkqwknpdj.dll
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3340

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\fkqwknpdj.dll
          Filesize

          18KB

          MD5

          f3517879d2068cf6ee9fa6b62b467e81

          SHA1

          8eb2d57357aaab4142230685db3d48e75130c6f6

          SHA256

          0fe448839d7d81cf3792dab07a87f21b4a3208353f609028cd1b60055cc54c7d

          SHA512

          e5aa990db5757ef65111cc38e51d93a7fea108bed6f41b266745fd446dee69815ac5df306310768d8446051ea77874f70786011246c14b955b9c6d4ad7276944

          Download Submit

        • memory/3340-4-0x0000000002140000-0x000000000215D000-memory.dmp

          Filesize

          116KB

          Download

        • memory/3340-5-0x0000000002140000-0x000000000215D000-memory.dmp

          Filesize

          116KB

          Download