Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 16:07
Behavioral task
behavioral1
Sample
TEST.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
TEST.exe
Resource
win10v2004-20240226-en
General
-
Target
TEST.exe
-
Size
10.8MB
-
MD5
53490c8526926afdd434f905ac3f5b93
-
SHA1
e224af5c678a0d7ead4e62dd08975087f12a8875
-
SHA256
6d38be07d9fc779ad72cc1d832aed647333773e795b1d497837a08fcc91b56b5
-
SHA512
2bb3ae9d37f59f7d238fc6fdf42007c8d6a1f3c24f78ce5843d21fd9d700e0b7446e7265fd02d9e9a2e54548551729028344214d182cd09b534615f76452a8c0
-
SSDEEP
196608:ThcWJYACNPAVSwLRXgWPmpzdhqiUeNvX+wfm/pf+xfdkR0ZWKsnOrIWOzW0DaqkH:DJY2V5L1V8dvvX+9/pWFGRiBsnOrIWeO
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
TEST.exepid process 2696 TEST.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI30002\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
TEST.exedescription pid process target process PID 3000 wrote to memory of 2696 3000 TEST.exe TEST.exe PID 3000 wrote to memory of 2696 3000 TEST.exe TEST.exe PID 3000 wrote to memory of 2696 3000 TEST.exe TEST.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30002\python311.dllFilesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
-
memory/2696-48-0x000007FEF54D0000-0x000007FEF5AB8000-memory.dmpFilesize
5.9MB