Analysis
-
max time kernel
143s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/04/2023, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe
Resource
win10v2004-20230220-en
General
-
Target
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe
-
Size
2.8MB
-
MD5
a282da0cf8b4a35a1fec2a5751682acf
-
SHA1
0d56c63f4afd00d7bd67fe561a2b7de0a08ff365
-
SHA256
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
-
SHA512
c62e12270451702b4deeece6a33ef218e1d909d2c99946d45653428edfdae72f9ff20bd05bc2839fb0068abe9217ab469cc12fea748b00a7b666848003390743
-
SSDEEP
49152:VgprPO37fzH4A6hanqNmZBb9TcAY8bsTLtWfWT:WprPO37fzH4A6h0PtcAYbmW
Malware Config
Signatures
-
Detects MosaicLoader payload 5 IoCs
resource yara_rule behavioral1/memory/760-56-0x0000000000400000-0x00000000004B7000-memory.dmp family_mosaicloader behavioral1/memory/760-59-0x0000000000400000-0x00000000004B7000-memory.dmp family_mosaicloader behavioral1/memory/760-60-0x0000000000400000-0x00000000004B7000-memory.dmp family_mosaicloader behavioral1/memory/760-61-0x0000000000400000-0x00000000004B7000-memory.dmp family_mosaicloader behavioral1/memory/760-63-0x0000000000400000-0x00000000004B7000-memory.dmp family_mosaicloader -
MosaicLoader
MosaicLoader has been first discovered in July 2021, written in C++.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28 PID 1832 wrote to memory of 760 1832 4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe"C:\Users\Admin\AppData\Local\Temp\4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe"C:\Users\Admin\AppData\Local\Temp\4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe"2⤵PID:760
-