9b4afe688d34f7ed94d872bd3c34d7ac6e4f1ec5b605223bc743bf88c6fb8e4c | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 11:52

Sharing

Report Analysis Logs

General

Target

Ethical.exe
Size

17.3MB
MD5

10c4591b70b04030b5724abc75c703f7
SHA1

d66ced77c9f2e3d52a1dd47ce1fdf29b85005952
SHA256

bf510b596de5017c0fe960e89effb9de8cbfc84e4c8a5ae5459ba7d6182dc54c
SHA512

ec7c16e954460553928a11d6a53ab551433c5e17862e6fbf7c9210211d6cd6821974e3f063a08255a958c0d35de821ba36893042ed85f2c5504c97e7ba4daf55
SSDEEP

393216:4EkZQbFG8fdQuslSl99oWOv+9fg1e/qbETER3e:4hQbFG8fdQu9DorvSY1eCbETE

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1088	Ethical.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1088	2084	Ethical.exe	28
PID 2084 wrote to memory of 1088	2084	Ethical.exe	28
PID 2084 wrote to memory of 1088	2084	Ethical.exe	28

C:\Users\Admin\AppData\Local\Temp\Ethical.exe
"C:\Users\Admin\AppData\Local\Temp\Ethical.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\Ethical.exe
  "C:\Users\Admin\AppData\Local\Temp\Ethical.exe"
  2⤵
  - Loads dropped DLL
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20842\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit