Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    04/08/2023, 20:46

General

  • Target

    fi30mtm7384bj.exe

  • Size

    6.6MB

  • MD5

    aec2444fff7f041129caeba95f5c0cd8

  • SHA1

    541ec892c01311d4ecb5bd00e94fcb1292923c8f

  • SHA256

    c57150dd70cf2780decee027a2dfac8e01a698f219ef3397d8706a100a1d854a

  • SHA512

    9b0c02ac8420e5517669040a8260d27913b2197a4546b2b6910084a5318be5fad2d967a30526f22474fb30556cceaa7fed4ec7042ac3dff093f68ad11eb857a6

  • SSDEEP

    98304:U5zTX4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqfvsJ1YPwIu/:UVX4FMIZETKwjPePdrQJ/BNOqAYPL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe
    "C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe
      "C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"
      2⤵
      • Loads dropped DLL
      PID:1124

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI11522\python311.dll

          Filesize

          5.5MB

          MD5

          5a5dd7cad8028097842b0afef45bfbcf

          SHA1

          e247a2e460687c607253949c52ae2801ff35dc4a

          SHA256

          a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

          SHA512

          e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

        • \Users\Admin\AppData\Local\Temp\_MEI11522\python311.dll

          Filesize

          5.5MB

          MD5

          5a5dd7cad8028097842b0afef45bfbcf

          SHA1

          e247a2e460687c607253949c52ae2801ff35dc4a

          SHA256

          a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

          SHA512

          e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858