Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-02-2023 19:10
Behavioral task
behavioral1
Sample
Creal.exe
Resource
win7-20220812-en
General
-
Target
Creal.exe
-
Size
14.9MB
-
MD5
00b471bd631a06fb4b21b345effb880b
-
SHA1
b6e52506741ba627a96e681cb381db90c3fd21ca
-
SHA256
22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883
-
SHA512
29c403af0115254f1b449c3a0d7de2eb816ad5458b9168f72b80aa28684ceec6e6e43a79e9f9832bdd6cc58e6700d51b6e587be320dea1654d584df95c1df9c1
-
SSDEEP
393216:GxAlnAT6K4/m3pWFqyoBgsSI7oeCMJf0:XlAWK4K91p75CMJ0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Creal.exepid process 1496 Creal.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI3642\python310.dll upx \Users\Admin\AppData\Local\Temp\_MEI3642\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Creal.exedescription pid process target process PID 364 wrote to memory of 1496 364 Creal.exe Creal.exe PID 364 wrote to memory of 1496 364 Creal.exe Creal.exe PID 364 wrote to memory of 1496 364 Creal.exe Creal.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI3642\python310.dllFilesize
1.4MB
MD5bbcb74867bd3f8a691b1f0a394336908
SHA1aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA256800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
SHA51200745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
-
\Users\Admin\AppData\Local\Temp\_MEI3642\python310.dllFilesize
1.4MB
MD5bbcb74867bd3f8a691b1f0a394336908
SHA1aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA256800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
SHA51200745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
-
memory/364-54-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmpFilesize
8KB
-
memory/1496-55-0x0000000000000000-mapping.dmp
-
memory/1496-59-0x000007FEF5E50000-0x000007FEF62BE000-memory.dmpFilesize
4.4MB