Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 23:07
Behavioral task
behavioral1
Sample
Karma/Karma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Karma/Karma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Karma/main.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Karma/main.exe
Resource
win10v2004-20240508-en
General
-
Target
Karma/main.exe
-
Size
9.6MB
-
MD5
0a3a02ddeff49d3b358fa9f2a0dbc10a
-
SHA1
683f5415cef48235a4617e3c9ff17834c37422ca
-
SHA256
3cbe12345bb51f8b87528be5fc3f156bb8e0ed7c855b1740f61fc87bac7709d9
-
SHA512
92f8daf8456565753602071c9bbb678edc4d902668682f24888c714c9aac7710e35098743e51a12ec92cbdd8652f43a259307a88260e7a9f327d5559c50ef2d6
-
SSDEEP
196608:j80FzJRL2Vmd6+DxWVuSn80urLZy7YM30Lzaj7XCXpFOoU7Qc8IdXo:PlRL2Vmd6mxWj8J0Gzaj7yXP1jc8CY
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
main.exepid process 1948 main.exe 1948 main.exe 1948 main.exe 1948 main.exe 1948 main.exe 1948 main.exe 1948 main.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 3048 wrote to memory of 1948 3048 main.exe main.exe PID 3048 wrote to memory of 1948 3048 main.exe main.exe PID 3048 wrote to memory of 1948 3048 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\api-ms-win-core-file-l1-2-0.dllFilesize
20KB
MD5b59d773b0848785a76baba82d3f775fa
SHA11b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82
SHA2560dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0
SHA512cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\api-ms-win-core-file-l2-1-0.dllFilesize
20KB
MD54c9bf992ae40c7460a029b1046a7fb5e
SHA179e13947af1d603c964cce3b225306cadff4058b
SHA25618655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4
SHA512c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD59d8e7a90dd0d54b7ccde435b977ee46d
SHA115cd12089c63f4147648856b16193cf014e6764f
SHA256dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6
SHA512339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\api-ms-win-core-processthreads-l1-1-1.dllFilesize
20KB
MD5d399c926466f044f183faa723ba59120
SHA1a9534b4910888d70eefba6fcc3376f2549cb4a05
SHA25619b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1
SHA512fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\api-ms-win-core-timezone-l1-1-0.dllFilesize
20KB
MD5ea5f768b9a1664884ae4ae62cec90678
SHA1ae08e80431da7f4e8f1e5457c255cc360ef1cac0
SHA25624f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d
SHA512411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\python39.dllFilesize
4.3MB
MD52135da9f78a8ef80850fa582df2c7239
SHA1aac6ad3054de6566851cae75215bdeda607821c4
SHA256324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
SHA512423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\ucrtbase.dllFilesize
1.1MB
MD5b0397bb83c9d579224e464eebf40a090
SHA181efdfe57225dfe581aafb930347535f08f2f4ce
SHA256d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66
SHA512e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3