Analysis

  • max time kernel
    1561s
  • max time network
    1567s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2023 18:11

General

  • Target

    source_prepared.exe

  • Size

    76.6MB

  • MD5

    5ff1ae99dac344b67a90976043b3b8ca

  • SHA1

    ec8d7ad6df29ceed3a494e4fbb61ba827af13fde

  • SHA256

    81936d79154b6e882a767c6de06742eab1a127c053ec2910f4c4fa78d5661ffb

  • SHA512

    562f414f48c32e45d8bf8d07fe15c4e086ffcbb5a9a5d0a43940ed7d151da887b8ce0948772a6b9172a7f70d3b0cc485e931fcd9975ea9f5e1b768177a336534

  • SSDEEP

    1572864:j2MbiJR5Q3jX2UWSk8IpG7V+VPhqb+TDE7GjCMWlsnghowmaOlldIlWaawxBFbVI:jZbC+7ESkB05awb+THubsghfxOlldSjJ

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Loads dropped DLL
      PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI16842\python311.dll

    Filesize

    1.6MB

    MD5

    8ea69ca2292c3af9cdb46dded91bc837

    SHA1

    72de7df68b2c336720d1528c34f21ff00ed7a2ce

    SHA256

    3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

    SHA512

    fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

  • \Users\Admin\AppData\Local\Temp\_MEI16842\python311.dll

    Filesize

    1.6MB

    MD5

    8ea69ca2292c3af9cdb46dded91bc837

    SHA1

    72de7df68b2c336720d1528c34f21ff00ed7a2ce

    SHA256

    3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

    SHA512

    fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

  • memory/2680-1249-0x000007FEF5D20000-0x000007FEF6309000-memory.dmp

    Filesize

    5.9MB