49208ab1030a9aeb8ccc2df3ae7b0d9f9990dc13e205e3a047b909c3057c562b | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

hitter.exe
Size

12.7MB
MD5

49adc6de79663350f57b86c3a0779775
SHA1

6961fb9ecc912a368847ae75e092c330478ddc01
SHA256

49208ab1030a9aeb8ccc2df3ae7b0d9f9990dc13e205e3a047b909c3057c562b
SHA512

891232ae3932194dead2bad6854d813b0ccddf245cf31cd7d15afceb4dc8a9dd941eabd0d8b224f12211bf2b107c4c78b05801c4b59265c59db6a07531c75e9b
SSDEEP

393216:vOQd4JWQsUcR4NzPdQJlewF3MnG3PdFTXfU8/7y55:2q4YQFndQT3MGfjrv

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2748	hitter.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2748	2176	hitter.exe	29
PID 2176 wrote to memory of 2748	2176	hitter.exe	29
PID 2176 wrote to memory of 2748	2176	hitter.exe	29

C:\Users\Admin\AppData\Local\Temp\hitter.exe
"C:\Users\Admin\AppData\Local\Temp\hitter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\hitter.exe
  "C:\Users\Admin\AppData\Local\Temp\hitter.exe"
  2⤵
  - Loads dropped DLL
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21762\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit