Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
11-10-2021 01:38
Static task
static1
Behavioral task
behavioral1
Sample
B64Str-B64Decoded.bin.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
B64Str-B64Decoded.bin.exe
Resource
win10v20210408
General
-
Target
B64Str-B64Decoded.bin.exe
-
Size
6.7MB
-
MD5
536444a6c9cdc019b47330725e1ac0d2
-
SHA1
7c01fc6c4a6ce3710a3462bec304ee483f7a5910
-
SHA256
0055fab035e9d26b72bb550b88eba4972f56d3885c0b013a83286bdeb7496de1
-
SHA512
17782dfd7c742596450d7aeed3ccbe87c3e122e7298d2f164f792a40ed846aa05d9b404d2d9b132466fff595d77e215a509c7692d2b7a5849c6135592d7fff7b
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
B64Str-B64Decoded.bin.exepid process 1568 B64Str-B64Decoded.bin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
B64Str-B64Decoded.bin.exedescription pid process target process PID 1524 wrote to memory of 1568 1524 B64Str-B64Decoded.bin.exe B64Str-B64Decoded.bin.exe PID 1524 wrote to memory of 1568 1524 B64Str-B64Decoded.bin.exe B64Str-B64Decoded.bin.exe PID 1524 wrote to memory of 1568 1524 B64Str-B64Decoded.bin.exe B64Str-B64Decoded.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\B64Str-B64Decoded.bin.exe"C:\Users\Admin\AppData\Local\Temp\B64Str-B64Decoded.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B64Str-B64Decoded.bin.exe"C:\Users\Admin\AppData\Local\Temp\B64Str-B64Decoded.bin.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI15242\python39.dllMD5
64fde73c54618af1854a51db302192fe
SHA1c5580dcea411bfed2d969551e8089aab8285a1d8
SHA256d44753fe884b228da36acb17c879b500aeb0225a38fb7ca142fb046c60b22204
SHA512a7d368301a27ee07a542e45e9ad27683707979fb198b887b66b523609f69e3327d4b77b7edc988c73a4fe26c44bff3abfcd032a991cd730fd8e0de2dad2e3a06
-
\Users\Admin\AppData\Local\Temp\_MEI15242\python39.dllMD5
64fde73c54618af1854a51db302192fe
SHA1c5580dcea411bfed2d969551e8089aab8285a1d8
SHA256d44753fe884b228da36acb17c879b500aeb0225a38fb7ca142fb046c60b22204
SHA512a7d368301a27ee07a542e45e9ad27683707979fb198b887b66b523609f69e3327d4b77b7edc988c73a4fe26c44bff3abfcd032a991cd730fd8e0de2dad2e3a06
-
memory/1568-53-0x0000000000000000-mapping.dmp
-
memory/1568-56-0x000007FEFBA11000-0x000007FEFBA13000-memory.dmpFilesize
8KB