Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 05:00
Behavioral task
behavioral1
Sample
Decompiler/Decompiler.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Decompiler/Decompiler.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
idkk.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
idkk.pyc
Resource
win10v2004-20240508-en
General
-
Target
Decompiler/Decompiler.exe
-
Size
15.9MB
-
MD5
7b7446912cf7e94e32d2a4cabaec6a42
-
SHA1
7b253f66be8f8527c63b6691a0ee166faf9f1d32
-
SHA256
7ffe94ceda656350ecafcc1084a11ebaa6d01479edcd7ddfd1a3a9e08f442682
-
SHA512
dfc2603de782cc6177efca8904378165a4dc210577b55057a390e9b78760f3b87b9eb7a24f6e0ac3c2080187d2ec690a24b095e036db9e4d5bccd7bdaea76501
-
SSDEEP
393216:emc0gP8AxYDX1+TtIiFGMiP1gZY9Z8D8CclNET02O:e30bX71QtIWiP2a8DZcrL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2280 Decompiler.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2280 1956 Decompiler.exe 29 PID 1956 wrote to memory of 2280 1956 Decompiler.exe 29 PID 1956 wrote to memory of 2280 1956 Decompiler.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Decompiler\Decompiler.exe"C:\Users\Admin\AppData\Local\Temp\Decompiler\Decompiler.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Decompiler\Decompiler.exe"C:\Users\Admin\AppData\Local\Temp\Decompiler\Decompiler.exe"2⤵
- Loads dropped DLL
PID:2280
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD53c388ce47c0d9117d2a50b3fa5ac981d
SHA1038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35