54c62308e913a7bce9560f9e9586836b87d1ccad25b1f45f8b787584191f3096

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mistsploit.exe
Size

17.5MB
MD5

238a4d03a640d79becc8c842fd94bda9
SHA1

f5a9496a12b68c7b372929480605cf2c98479bdc
SHA256

54c62308e913a7bce9560f9e9586836b87d1ccad25b1f45f8b787584191f3096
SHA512

e648b9ce90c59a8a1855cc7feb9a359bcd1e2323ca695f137083c84c28b2f19fcfbb294a68652e4f30bd6bc9cef047254ee6ab0dd91a04bcae3cd8fd5d9f7fc5
SSDEEP

393216:vo9D7E9QdXGpix93kh2Jp5M5BreY3G2Q0ooKRKell:Q9cQ+ix93khRF2v0yRll

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1204	mistsploit.exe
1204	mistsploit.exe
1204	mistsploit.exe
1204	mistsploit.exe
1204	mistsploit.exe
1204	mistsploit.exe
1204	mistsploit.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001c7c8-160.dat	upx
behavioral1/memory/1204-162-0x000007FEF6100000-0x000007FEF656E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1204	3024	mistsploit.exe	28
PID 3024 wrote to memory of 1204	3024	mistsploit.exe	28
PID 3024 wrote to memory of 1204	3024	mistsploit.exe	28

C:\Users\Admin\AppData\Local\Temp\mistsploit.exe
"C:\Users\Admin\AppData\Local\Temp\mistsploit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\mistsploit.exe
  "C:\Users\Admin\AppData\Local\Temp\mistsploit.exe"
  2⤵
  - Loads dropped DLL
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30242\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
49c3ffd47257dbcb67a6be9ee112ba7f

SHA1
04669214375b25e2dc8a3635484e6eeb206bc4eb

SHA256
322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

SHA512
bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30242\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
588bd2a8e0152e0918742c1a69038f1d

SHA1
9874398548891f6a08fc06437996f84eb7495783

SHA256
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

SHA512
32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30242\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d699333637db92d319661286df7cc39e

SHA1
0bffb9ed366853e7019452644d26e8e8f236241b

SHA256
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

SHA512
6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30242\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30242\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30242\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30242\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f62b66f451f2daa8410ad62d453fa0a2

SHA1
4bf13db65943e708690d6256d7ddd421cc1cc72b

SHA256
48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

SHA512
d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

Download Submit
memory/1204-162-0x000007FEF6100000-0x000007FEF656E000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads