Analysis
-
max time kernel
76s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07-10-2023 23:35
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20230915-en
General
-
Target
source_prepared.exe
-
Size
53.0MB
-
MD5
016863001c619fdea2bbc690a26db8c6
-
SHA1
632d4f55d6712262fcc2786de41f632450a43a52
-
SHA256
5b4749f4e78c16213ce53c504511c0d2c7eb8e2b2f5a97a800a5356cfd1389c6
-
SHA512
0b7ec55e3a7a8396a9b0a0713fbf6acd8f8afa30e3f35408967dbbf0d13c779fd14a7831220cfc95c52ae0b11caef293933b88747e9978486fe1af8e78e91bc2
-
SSDEEP
1572864:m2MTiQYHRL1PSk8IpG7V+VPhq2+O1E7lftwHpiIOWaaQBo36C:mZTixxhSkB05aw2+OxJiVtaQ+36
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
source_prepared.exepid Process 2896 source_prepared.exe -
Processes:
resource yara_rule behavioral1/files/0x000400000001cb41-1147.dat upx behavioral1/files/0x000400000001cb41-1148.dat upx behavioral1/memory/2896-1149-0x000007FEF54C0000-0x000007FEF5AA9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
source_prepared.exedescription pid Process procid_target PID 2600 wrote to memory of 2896 2600 source_prepared.exe 29 PID 2600 wrote to memory of 2896 2600 source_prepared.exe 29 PID 2600 wrote to memory of 2896 2600 source_prepared.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f