Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 01:01

General

  • Target

    KqConfig 2.5.7.9.exe

  • Size

    14.0MB

  • MD5

    326fc39a218b9c5d26852c491147fe0d

  • SHA1

    76b7da5c1150fdf0dc4f0fbc894a51a43094f06e

  • SHA256

    4676680b22fe27a2e2461b0f7f7bb9a1f7978d85ec84f706b0901b738d931218

  • SHA512

    f5e544866ed7b4783198257e258e270a8b3b6cc21c0bce9725f675c9af5d15d8c78d502da7aecabf3006ae3bf1489c8003430d3aadfb726eaac4d739b070edcf

  • SSDEEP

    393216:1EnUr64POOZhHSkI8jKXt3C9rsVdyH3hOj2O1S2B:3rnPdhH8XhC9rsVoMjTSI

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KqConfig 2.5.7.9.exe
    "C:\Users\Admin\AppData\Local\Temp\KqConfig 2.5.7.9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nso16A.tmp\Codejock.cjstyles

    Filesize

    1.3MB

    MD5

    6daada4b8d7ae20896d601d189880601

    SHA1

    7ce6e2cf2f8d21a2241feafe704c42e78527c6ae

    SHA256

    9bc80ce244a42af3e4c539bd131e71dc97cf258b90667e538b4fd08ff98665c5

    SHA512

    3e23ecfe48d23976230c6e83b0b0f894ad25d9f150811b2487f9a88e0a234e947842303e0d577da016ad285442f58b970736f5bc4779c8d61aa482934a455704

  • \Users\Admin\AppData\Local\Temp\nso16A.tmp\ISSkinEx.dll

    Filesize

    379KB

    MD5

    a80a2c59aad01a5bd369d479f4f3cf3d

    SHA1

    c01b281cdaeba9f468c18185e6f01f78a0abf287

    SHA256

    282f40ed72cfc801ef88ab72a80c8824957aa554ece3b74842b48ecedfcf4755

    SHA512

    db67c30e07245e1e0ee5514faf35f6fdfd94a2884cdf82f7daba1eac571067448483b5564f758e273a57ae020941322c2174827ffef1915fc37a74f0fda2d39d

  • \Users\Admin\AppData\Local\Temp\nso16A.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • memory/2412-91-0x0000000076C80000-0x0000000076D1D000-memory.dmp

    Filesize

    628KB

  • memory/2412-92-0x0000000075BF0000-0x0000000075C90000-memory.dmp

    Filesize

    640KB

  • memory/2412-93-0x0000000075D40000-0x000000007698A000-memory.dmp

    Filesize

    12.3MB

  • memory/2412-94-0x0000000076C20000-0x0000000076C77000-memory.dmp

    Filesize

    348KB

  • memory/2412-95-0x0000000076FF0000-0x000000007714C000-memory.dmp

    Filesize

    1.4MB

  • memory/2412-96-0x0000000077590000-0x000000007761F000-memory.dmp

    Filesize

    572KB

  • memory/2412-97-0x00000000750C0000-0x00000000751B5000-memory.dmp

    Filesize

    980KB

  • memory/2412-99-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB

  • memory/2412-98-0x00000000756A0000-0x000000007583D000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-100-0x0000000074EF0000-0x000000007500C000-memory.dmp

    Filesize

    1.1MB

  • memory/2412-102-0x0000000074E20000-0x0000000074E52000-memory.dmp

    Filesize

    200KB

  • memory/2412-104-0x0000000075BF0000-0x0000000075C90000-memory.dmp

    Filesize

    640KB

  • memory/2412-105-0x0000000075D40000-0x000000007698A000-memory.dmp

    Filesize

    12.3MB

  • memory/2412-106-0x0000000076C20000-0x0000000076C77000-memory.dmp

    Filesize

    348KB

  • memory/2412-103-0x0000000076AF0000-0x0000000076B1A000-memory.dmp

    Filesize

    168KB

  • memory/2412-101-0x0000000074E60000-0x0000000074EEC000-memory.dmp

    Filesize

    560KB

  • memory/2412-108-0x0000000076FF0000-0x000000007714C000-memory.dmp

    Filesize

    1.4MB

  • memory/2412-109-0x00000000754F0000-0x00000000754F9000-memory.dmp

    Filesize

    36KB

  • memory/2412-112-0x0000000077590000-0x000000007761F000-memory.dmp

    Filesize

    572KB

  • memory/2412-113-0x0000000077150000-0x00000000771D3000-memory.dmp

    Filesize

    524KB

  • memory/2412-115-0x00000000756A0000-0x000000007583D000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-114-0x00000000750C0000-0x00000000751B5000-memory.dmp

    Filesize

    980KB

  • memory/2412-107-0x0000000075240000-0x00000000753DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-118-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB

  • memory/2412-120-0x0000000074DA0000-0x0000000074DD9000-memory.dmp

    Filesize

    228KB

  • memory/2412-119-0x0000000074E20000-0x0000000074E52000-memory.dmp

    Filesize

    200KB

  • memory/2412-117-0x0000000075010000-0x000000007503E000-memory.dmp

    Filesize

    184KB

  • memory/2412-116-0x0000000075070000-0x00000000750BC000-memory.dmp

    Filesize

    304KB

  • memory/2412-125-0x0000000075240000-0x00000000753DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-124-0x0000000076C20000-0x0000000076C77000-memory.dmp

    Filesize

    348KB

  • memory/2412-128-0x0000000077150000-0x00000000771D3000-memory.dmp

    Filesize

    524KB

  • memory/2412-129-0x00000000750C0000-0x00000000751B5000-memory.dmp

    Filesize

    980KB

  • memory/2412-130-0x00000000756A0000-0x000000007583D000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-134-0x0000000074E60000-0x0000000074EEC000-memory.dmp

    Filesize

    560KB

  • memory/2412-133-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB

  • memory/2412-136-0x0000000074DA0000-0x0000000074DD9000-memory.dmp

    Filesize

    228KB

  • memory/2412-137-0x0000000075BF0000-0x0000000075C90000-memory.dmp

    Filesize

    640KB

  • memory/2412-139-0x0000000075240000-0x00000000753DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-140-0x00000000754F0000-0x00000000754F9000-memory.dmp

    Filesize

    36KB

  • memory/2412-143-0x00000000750C0000-0x00000000751B5000-memory.dmp

    Filesize

    980KB

  • memory/2412-144-0x00000000756A0000-0x000000007583D000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-145-0x0000000075070000-0x00000000750BC000-memory.dmp

    Filesize

    304KB

  • memory/2412-148-0x0000000074E60000-0x0000000074EEC000-memory.dmp

    Filesize

    560KB

  • memory/2412-147-0x0000000010000000-0x0000000010064000-memory.dmp

    Filesize

    400KB

  • memory/2412-149-0x0000000074E20000-0x0000000074E52000-memory.dmp

    Filesize

    200KB

  • memory/2412-152-0x0000000076C80000-0x0000000076D1D000-memory.dmp

    Filesize

    628KB

  • memory/2412-153-0x0000000075BF0000-0x0000000075C90000-memory.dmp

    Filesize

    640KB

  • memory/2412-155-0x0000000075240000-0x00000000753DE000-memory.dmp

    Filesize

    1.6MB

  • memory/2412-160-0x0000000077150000-0x00000000771D3000-memory.dmp

    Filesize

    524KB

  • memory/2412-159-0x0000000077590000-0x000000007761F000-memory.dmp

    Filesize

    572KB

  • memory/2412-156-0x00000000754F0000-0x00000000754F9000-memory.dmp

    Filesize

    36KB

  • memory/2412-154-0x0000000076C20000-0x0000000076C77000-memory.dmp

    Filesize

    348KB

  • memory/2412-151-0x0000000074D60000-0x0000000074D96000-memory.dmp

    Filesize

    216KB

  • memory/2412-150-0x0000000074DA0000-0x0000000074DD9000-memory.dmp

    Filesize

    228KB

  • memory/2412-146-0x0000000075010000-0x000000007503E000-memory.dmp

    Filesize

    184KB

  • memory/2412-142-0x0000000077150000-0x00000000771D3000-memory.dmp

    Filesize

    524KB

  • memory/2412-138-0x0000000076C20000-0x0000000076C77000-memory.dmp

    Filesize

    348KB

  • memory/2412-135-0x0000000074E20000-0x0000000074E52000-memory.dmp

    Filesize

    200KB

  • memory/2412-132-0x0000000075010000-0x000000007503E000-memory.dmp

    Filesize

    184KB

  • memory/2412-131-0x0000000076AC0000-0x0000000076AE7000-memory.dmp

    Filesize

    156KB

  • memory/2412-127-0x0000000077590000-0x000000007761F000-memory.dmp

    Filesize

    572KB

  • memory/2412-123-0x0000000075BF0000-0x0000000075C90000-memory.dmp

    Filesize

    640KB

  • memory/2412-122-0x0000000076C80000-0x0000000076D1D000-memory.dmp

    Filesize

    628KB

  • memory/2412-121-0x0000000074D60000-0x0000000074D96000-memory.dmp

    Filesize

    216KB