Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:36
Behavioral task
behavioral1
Sample
trueking_account.exe
Resource
win7-20240221-en
General
-
Target
trueking_account.exe
-
Size
19.6MB
-
MD5
e382029edd1a13e758b6809d88afe5cd
-
SHA1
19d1fb74a9a4003bb5ffc7cb343b707f78181035
-
SHA256
b5eafc617e4b4d8e17d28c8bf5a920aba922bd538d4bcf537320cf0a20483fe8
-
SHA512
3f4fc7e9a6845536e494fb073d19063e866b2630da47c3ba6bae745afe45745cfcb1d0a3b3b5f8c56561b4c8483d485bdfff4b479564e078d1a0b27c5093ff9d
-
SSDEEP
393216:Fo9Du63QD08kE7hAT0L+9qz8YSJH+1JYJGcH6dpdwqYV1:q97Qx+0+9q4YSJH+1+QcmAqc
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
trueking_account.exepid process 1480 trueking_account.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22402\python311.dll upx behavioral1/memory/1480-109-0x000007FEF56C0000-0x000007FEF5CAE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
trueking_account.exedescription pid process target process PID 2240 wrote to memory of 1480 2240 trueking_account.exe trueking_account.exe PID 2240 wrote to memory of 1480 2240 trueking_account.exe trueking_account.exe PID 2240 wrote to memory of 1480 2240 trueking_account.exe trueking_account.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trueking_account.exe"C:\Users\Admin\AppData\Local\Temp\trueking_account.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\trueking_account.exe"C:\Users\Admin\AppData\Local\Temp\trueking_account.exe"2⤵
- Loads dropped DLL
PID:1480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD576eb1ad615ba6600ce747bf1acde6679
SHA1d3e1318077217372653be3947635b93df68156a4
SHA25630be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA5122b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb