Analysis
-
max time kernel
0s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 07:06
Behavioral task
behavioral1
Sample
4fe6a78b3acc6e4f636891bc5e4bd982.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4fe6a78b3acc6e4f636891bc5e4bd982.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
4fe6a78b3acc6e4f636891bc5e4bd982.exe
-
Size
4.6MB
-
MD5
4fe6a78b3acc6e4f636891bc5e4bd982
-
SHA1
d7f76fe8d5529a535885b1a34045790b3c74b37d
-
SHA256
c2c66ec47fc9c969de74cbb8ae050243e5c51e8033811cb04bd3b975d0037d1b
-
SHA512
ea313e8e2de3c3467b1b0aa2752cd7c6e53e7e7df7a64935035e012fe4904e64f8f391d30ebc8dfb268cd886f7855b0d2fa88915a1b502a946fd16588d4bca21
-
SSDEEP
98304:Xg1glG4ajy2toG3AMzo3kDS0TD8QqKiuW3Am1HF3F/DudFUy6pmTK:X84H0jBigCD2FAm+
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe -
resource yara_rule behavioral2/memory/2856-0-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/2856-17-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/2856-18-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/2856-37-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect behavioral2/memory/2856-40-0x0000000000400000-0x00000000008A9000-memory.dmp vmprotect -
Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0} 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMDispatch.QMRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\ = "QMDispatch.QMLibrary" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMDispatch.QMVBSRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMDispatch.QMRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049} 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMDispatch.QMVBSRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B} 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID\ = "{EBEB87A6-E151-4054-AB45-A6E094C5334B}" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll" 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32 4fe6a78b3acc6e4f636891bc5e4bd982.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID 4fe6a78b3acc6e4f636891bc5e4bd982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine" 4fe6a78b3acc6e4f636891bc5e4bd982.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe 2856 4fe6a78b3acc6e4f636891bc5e4bd982.exe