Analysis
- max time kernel
129s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
09/10/2023, 05:15
General
- Target Roopsai.exe
- Size 16.6MB
- Sample231009-fxkmescg39
- SHA256 50825b3dcf4e1bb958dfd1c2e49cc394f3a508f214ddce67bc111c40eed157e4
Malware Config
Signatures
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roopsai.exe"C:\Users\Admin\AppData\Local\Temp\Roopsai.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\Roopsai.exe" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1616-44-0x00000000032C0000-0x00000000032D0000-memory.dmp
memory/1616-5-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-12-0x0000000001370000-0x0000000001371000-memory.dmp
memory/1616-13-0x0000000001370000-0x0000000001371000-memory.dmp
memory/1616-18-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-25-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-36-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-41-0x0000000003220000-0x0000000003230000-memory.dmp
memory/1616-43-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-42-0x0000000003240000-0x0000000003250000-memory.dmp
memory/1616-46-0x0000000003280000-0x0000000003290000-memory.dmp
memory/1616-45-0x0000000003270000-0x0000000003280000-memory.dmp
memory/1616-53-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/1616-47-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/1616-48-0x00000000032B0000-0x00000000032C0000-memory.dmp
memory/1616-49-0x00000000032D0000-0x00000000032E0000-memory.dmp
memory/1616-50-0x00000000032E0000-0x00000000032F0000-memory.dmp
memory/1616-51-0x00000000032F0000-0x0000000003300000-memory.dmp
memory/1616-52-0x0000000002FA0000-0x0000000003FA0000-memory.dmp
memory/3452-0-0x0000000000400000-0x000000000042B000-memory.dmp