eb06b198bf42d7c35111dc76c27db1f77bfba7b034081183614f938d07d26269

Resubmissions

19-04-2024 04:24

240419-e1tttshf8y 10

19-04-2024 04:20

240419-eygrgshe9s 10

19-04-2024 04:05

240419-eny8sagb93 10

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celex.exe
Size

21.4MB
MD5

e2b29c99e4c748bc6f410c30b7e2401c
SHA1

daec0a0361f168e05ead55eadfa41458042bf9a1
SHA256

eb06b198bf42d7c35111dc76c27db1f77bfba7b034081183614f938d07d26269
SHA512

d6c410af494d5da1cfd9a998d5e830d4779e987fcf63542e4036e1d1376f7c6b53268cb0e134846ca7c3ed6af111217c35ca17750cb77d203219a9b1d939c145
SSDEEP

393216:5L9yy9lm6rQN+rrB+A/pWNuR8XuZEc2BsnJVeDBXW2DmG5kHTy:Z9Z9lQcrrB+A/pWNuZ4GJsBXTqz

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

Celex.exe

pid process

2464 Celex.exe

pid	process
2464	Celex.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2464-152-0x000007FEF5750000-0x000007FEF5D38000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Celex.exe

description	pid	process	target process
PID 3048 wrote to memory of 2464	3048	Celex.exe	Celex.exe
PID 3048 wrote to memory of 2464	3048	Celex.exe	Celex.exe
PID 3048 wrote to memory of 2464	3048	Celex.exe	Celex.exe

C:\Users\Admin\AppData\Local\Temp\Celex.exe
"C:\Users\Admin\AppData\Local\Temp\Celex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\Celex.exe
"C:\Users\Admin\AppData\Local\Temp\Celex.exe"
2⤵
- Loads dropped DLL
PID:2464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll
Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/2464-152-0x000007FEF5750000-0x000007FEF5D38000-memory.dmp

Filesize
5.9MB

Download