48a2769f938aa635ac1294bba40ffab3b6191c9159f5c322496bc764aa6b9c76 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SigmaTool.exe
Size

57.4MB
MD5

1e858a23b1654f6572155fb1a5bad9f0
SHA1

a8e461c9004c81c12ced710724a63563529937ae
SHA256

48a2769f938aa635ac1294bba40ffab3b6191c9159f5c322496bc764aa6b9c76
SHA512

de46159d37d7858bbdcff67f8995a554d062fece323908e136f0bcfa9ae21755618670a54c13d44a1cecd6dd583dd570cf6017fae713d672f53a19ccc3b051f4
SSDEEP

1572864:AS1gy6fnJXGMK4XRsbkEgjfBmMKYOESCU/+k3z7F:A4gy+gYRSgjfBmMKySC++k3z7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1628	SigmaTool.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1628	1632	SigmaTool.exe	29
PID 1632 wrote to memory of 1628	1632	SigmaTool.exe	29
PID 1632 wrote to memory of 1628	1632	SigmaTool.exe	29

C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe
"C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe
  "C:\Users\Admin\AppData\Local\Temp\SigmaTool.exe"
  2⤵
  - Loads dropped DLL
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16322\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit