Analysis
-
max time kernel
104s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-02-2023 20:00
Static task
static1
Behavioral task
behavioral1
Sample
python-3.11.2.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
python-3.11.2.exe
-
Size
307.5MB
-
MD5
46dcfe95ce4b04837cd93d684e926a51
-
SHA1
77949607ef3908fa2feda27e8ec39c21779ef041
-
SHA256
aa349ad45bb48e85b5cd1b55308ae835353859219f28ece9685c8ae552e8e63a
-
SHA512
4961a0224d6e1f8b7f3126f1a2650ebc3685ca1ca2c3399a03db57243605e21be382e485dc0638cce7a1aa27f6f67669e7d2b2f8823687eb0c566df2ccaefa2e
-
SSDEEP
24576:hn5q0CD6pcOb0QjwRdPmXCcXTM0jzRsE8IpZujAp/7TniOe63GpF+1A4U4aPTx0j:Tq0CDscLQjwXmXCdgk+lKaDgF1z1M
Malware Config
Extracted
Family
aurora
C2
185.106.93.135:8081
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
python-3.11.2.exedescription pid process target process PID 1276 set thread context of 1236 1276 python-3.11.2.exe python-3.11.2.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
python-3.11.2.exedescription pid process target process PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe PID 1276 wrote to memory of 1236 1276 python-3.11.2.exe python-3.11.2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"2⤵PID:1236
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-54-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-55-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-56-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-57-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-58-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-59-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-60-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-61-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmpFilesize
4KB
-
memory/1236-62-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-64-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-65-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-66-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-67-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-68-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-69-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-70-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-71-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-72-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-73-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-74-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-75-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-76-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-77-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-78-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-79-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1236-80-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB