Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01-10-2023 02:09
Behavioral task
behavioral1
Sample
celestial.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
celestial.exe
Resource
win10v2004-20230915-en
General
-
Target
celestial.exe
-
Size
71.4MB
-
MD5
fa5e4a96c7750a4969f2cc05ff0e0f5a
-
SHA1
86397c751293d30300c80040980776962949ffc5
-
SHA256
f2668fad642ebff8f6eb027a1624f273f195ef31a0e4213516848f0a4bf8c733
-
SHA512
1833aecca6fbacf56d15165314efccef1d2f22c35f2090fa5b0115214e6514150c712e509f3c79b39599faac9bc73c405e0f4cce3cafa6c1d1afbe539ae669f2
-
SSDEEP
1572864:Q2MQqQxHvJFSk8IpG7V+VPhqGDE7lBaaUHUzvW8J7TwGb94V9sWFYKZlwQFN7:QZQq6PJFSkB05awGTaU0SqEGCfsU9UQb
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
celestial.exepid Process 2720 celestial.exe -
Processes:
resource yara_rule behavioral1/files/0x000400000001cb15-1247.dat upx behavioral1/files/0x000400000001cb15-1248.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
celestial.exedescription pid Process procid_target PID 1328 wrote to memory of 2720 1328 celestial.exe 28 PID 1328 wrote to memory of 2720 1328 celestial.exe 28 PID 1328 wrote to memory of 2720 1328 celestial.exe 28
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee