Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 03:17
Behavioral task
behavioral1
Sample
Vegas 22 Installer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Vegas 22 Installer.exe
Resource
win10v2004-20240426-en
General
-
Target
Vegas 22 Installer.exe
-
Size
17.8MB
-
MD5
2269f966fac6608689b27c8fd0f8f4b6
-
SHA1
72b19b33010b5d130b4141aa3be69d69981155bb
-
SHA256
d54d3491570941698ac7e29ceedc611331e1b42b802ff53b19ff81fe2d3bd268
-
SHA512
10d76dffd87b08f141f7aaa925d5da68df181bb32ee877b888f1649bb84af1f98bc0fcedafc089c4c35b0264bc8f93d4604fd651779cb8595e0b799f6066d55b
-
SSDEEP
393216:XqPnLFXlrPmQ8DOETgsvfG3ghjzvE2PipK5aSq:aPLFXNOQhE8QjY+IKM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Vegas 22 Installer.exepid process 2792 Vegas 22 Installer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI21962\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Vegas 22 Installer.exedescription pid process target process PID 2196 wrote to memory of 2792 2196 Vegas 22 Installer.exe Vegas 22 Installer.exe PID 2196 wrote to memory of 2792 2196 Vegas 22 Installer.exe Vegas 22 Installer.exe PID 2196 wrote to memory of 2792 2196 Vegas 22 Installer.exe Vegas 22 Installer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vegas 22 Installer.exe"C:\Users\Admin\AppData\Local\Temp\Vegas 22 Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Vegas 22 Installer.exe"C:\Users\Admin\AppData\Local\Temp\Vegas 22 Installer.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI21962\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
memory/2792-113-0x000007FEF5860000-0x000007FEF5CCE000-memory.dmpFilesize
4.4MB