2f0938d6bd9306b7bd6b7a1367503c3c00206da7975d3e95ab2b1f39366e0234 | Triage

Resubmissions

15-04-2024 19:47

240415-yhvsysee92 10

11-02-2024 21:53

240211-1rtncsbh6y 10

11-02-2024 16:00

240211-tf4wmahe8s 10

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 19:47

Sharing

Report Analysis Logs

General

Target

Tools.exe
Size

14.3MB
MD5

5e17678827dab1a21e00558406819f23
SHA1

640c6b18840eda6b89f0fef1b890e672df61658b
SHA256

2f0938d6bd9306b7bd6b7a1367503c3c00206da7975d3e95ab2b1f39366e0234
SHA512

f228a7c2bfb5248ec5dd35dcfc1ba29ab8c86458f9fa467d3d5acd55547c408640c2bf5dc2c3df3bcdc93c80700676003bd2bf4a5278b512510655a6562d1aba
SSDEEP

393216:uu7L/sQs+SyzdInEroXF14S2rn8h+1AcYBf6B/:uCL0QdSyCErU8Lj1A16

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2676	Tools.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2676	1772	Tools.exe	28
PID 1772 wrote to memory of 2676	1772	Tools.exe	28
PID 1772 wrote to memory of 2676	1772	Tools.exe	28

C:\Users\Admin\AppData\Local\Temp\Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\Tools.exe
  "C:\Users\Admin\AppData\Local\Temp\Tools.exe"
  2⤵
  - Loads dropped DLL
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI17722\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit