Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 12:49
Behavioral task
behavioral1
Sample
_RUNECE.vmp.exe
Resource
win7-20231023-en
General
-
Target
_RUNECE.vmp.exe
-
Size
71.0MB
-
MD5
4f82be843498084c59ebfdc9d3556d66
-
SHA1
1dff2674a86c42e574083b712372d147982f8305
-
SHA256
a614d740ca78216237022406c3b8df12dfe982d75d8973299d1ffa3a63974546
-
SHA512
377797d21da768b148eeab03eeaabe809ede00fa9bf89b85362318bab8fc5ab98cfced4a6aef11e4f8edfb4382c9b0397c6a25a79d4d7630203bdd4d68184247
-
SSDEEP
1572864:l2MerQqjqSk8IpG7V+VPhqCnE7R6u9jZS9uWdErnUEpiqY9PNdv:lZerdGSkB05awCmz91k2rn8pDdv
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
_RUNECE.vmp.exepid process 2364 _RUNECE.vmp.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll upx \Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll upx behavioral1/memory/2364-1262-0x000007FEF5C20000-0x000007FEF609F000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
_RUNECE.vmp.exepid process 2364 _RUNECE.vmp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
_RUNECE.vmp.exedescription pid process target process PID 3036 wrote to memory of 2364 3036 _RUNECE.vmp.exe _RUNECE.vmp.exe PID 3036 wrote to memory of 2364 3036 _RUNECE.vmp.exe _RUNECE.vmp.exe PID 3036 wrote to memory of 2364 3036 _RUNECE.vmp.exe _RUNECE.vmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2364
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD52dcee515eef346a7c77d2e6d37e6d761
SHA19daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1.4MB
MD52dcee515eef346a7c77d2e6d37e6d761
SHA19daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2