Analysis
-
max time kernel
356s -
max time network
363s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01-10-2023 23:05
Behavioral task
behavioral1
Sample
celestial.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
celestial.exe
Resource
win10v2004-20230915-en
General
-
Target
celestial.exe
-
Size
71.7MB
-
MD5
2303e486542f4d635a0c62c61f2baff0
-
SHA1
9a6639b3f7731ea76ec4587137f4c93f2129e7d2
-
SHA256
b45e481298e9824ca4184a0f653b27b3fc8aea5dc3bd157e06b14587bc3049f9
-
SHA512
733e60a895a13f2bd2405365fc1408c9b16df8ed5e768e75c2228c272d71fb160ab1bade093f595766078821126108e88ba445b8282f8f82934c7954a19fdf80
-
SSDEEP
1572864:T2MQqQxHv/FSk8IpG7V+VPhqGDE7lBaaUHUzvW8J7TwGb94V9sWpPQZKiAs2:TZQq6P/FSkB05awGTaU0SqEGCfsE4pAP
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
celestial.exepid Process 2580 celestial.exe -
Processes:
resource yara_rule behavioral1/files/0x000400000001cbcc-1249.dat upx behavioral1/files/0x000400000001cbcc-1250.dat upx behavioral1/memory/2580-1251-0x000007FEF59E0000-0x000007FEF5E4E000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
celestial.exepid Process 2580 celestial.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
celestial.exedescription pid Process procid_target PID 3020 wrote to memory of 2580 3020 celestial.exe 28 PID 3020 wrote to memory of 2580 3020 celestial.exe 28 PID 3020 wrote to memory of 2580 3020 celestial.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\celestial.exe"C:\Users\Admin\AppData\Local\Temp\celestial.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\celestial.exe"C:\Users\Admin\AppData\Local\Temp\celestial.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2580
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee