d9e64dc315a70cbd585fbd346f275166f91c86c6d5cbce4c1082544037ff0757 | Triage

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 10:48

Sharing

Report Analysis Logs

General

Target

Jaran.exe
Size

7.6MB
MD5

ab0e6c3241ae0557f5c7d590ed5b1080
SHA1

62798ec989048fa02e4ad4609d75f3d21e250ced
SHA256

d9e64dc315a70cbd585fbd346f275166f91c86c6d5cbce4c1082544037ff0757
SHA512

1400c9bb491e5f8745c23f3f6836d453730eb6f381da683cc3fff66f7a6d4e6c9fe240432b2b60927afae9747d08990628958d6a1cf41493f28d583f55cd3261
SSDEEP

196608:Q+v8ZdJdQmR8dA6luA8Qnf2ODjMnGydS8XWKzrbOsWIDa2kH:TqdJdQJluIF3MnG38XBzrbDpaHH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2684	Jaran.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2684	2988	Jaran.exe	29
PID 2988 wrote to memory of 2684	2988	Jaran.exe	29
PID 2988 wrote to memory of 2684	2988	Jaran.exe	29

C:\Users\Admin\AppData\Local\Temp\Jaran.exe
"C:\Users\Admin\AppData\Local\Temp\Jaran.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\Jaran.exe
  "C:\Users\Admin\AppData\Local\Temp\Jaran.exe"
  2⤵
  - Loads dropped DLL
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29882\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit