Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2023 22:23

General

  • Target

    LLR Logger.exe

  • Size

    78.6MB

  • MD5

    ef2f4f5beae8fa47a116d817ff96e7d1

  • SHA1

    963eda8b868061d7f6190d9e172c9485c6ca7748

  • SHA256

    5e433b412c346794c83637cb7ff61a660322b0be7bc74c5c06188aa35c0c1e42

  • SHA512

    bcfd05b52b7b778fa0c5e09db253b7517639254d33dcf1777d9a426a38cdda39e54af5477decd44a7fb8816736cf19447ecec27d75f1837d12f857da5d836f41

  • SSDEEP

    1572864:p2MbiJR5Q3jZDeSk8IpG7V+VPhq+ME73jC/WlsnghowmaOllkWIawZBxWBqX:pZbC+ISkB05aw+tuOsghfxOllkdawZnb

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LLR Logger.exe
    "C:\Users\Admin\AppData\Local\Temp\LLR Logger.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\LLR Logger.exe
      "C:\Users\Admin\AppData\Local\Temp\LLR Logger.exe"
      2⤵
      • Loads dropped DLL
      PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\python311.dll

    Filesize

    1.6MB

    MD5

    5792adeab1e4414e0129ce7a228eb8b8

    SHA1

    e9f022e687b6d88d20ee96d9509f82e916b9ee8c

    SHA256

    7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

    SHA512

    c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

  • \Users\Admin\AppData\Local\Temp\_MEI27802\python311.dll

    Filesize

    1.6MB

    MD5

    5792adeab1e4414e0129ce7a228eb8b8

    SHA1

    e9f022e687b6d88d20ee96d9509f82e916b9ee8c

    SHA256

    7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

    SHA512

    c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

  • memory/2632-1261-0x000007FEF55D0000-0x000007FEF5BB9000-memory.dmp

    Filesize

    5.9MB