Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 14:10
Behavioral task
behavioral1
Sample
27052024_1410_Quotation.exe
Resource
win7-20240508-en
General
-
Target
27052024_1410_Quotation.exe
-
Size
19.1MB
-
MD5
1a142f941297031dd315b2f3aff3b2b3
-
SHA1
51eaeab616ef8caf03e2f5e503a6f4aee2792071
-
SHA256
68754b8b2b5775692c5ad9d53a041848ab02701b660ec457eab3e2b039849864
-
SHA512
c4b98501a675d043fce6e5a1debe509d11b5673f7246d79f04daa4eed89cb0ea67e70fd292bf2acb1453796fd19d28426c6eb866614ef94f846caaf2d33bd0c3
-
SSDEEP
393216:Vryo9DF23QDxt5L1V8dJB+7/pWYkRuu3HBseZWdp9N5DHTy:RT9o3QNDR4B+7/pW+ux/O1z
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
27052024_1410_Quotation.exepid process 2884 27052024_1410_Quotation.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI16362\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
27052024_1410_Quotation.exedescription pid process target process PID 1636 wrote to memory of 2884 1636 27052024_1410_Quotation.exe 27052024_1410_Quotation.exe PID 1636 wrote to memory of 2884 1636 27052024_1410_Quotation.exe 27052024_1410_Quotation.exe PID 1636 wrote to memory of 2884 1636 27052024_1410_Quotation.exe 27052024_1410_Quotation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27052024_1410_Quotation.exe"C:\Users\Admin\AppData\Local\Temp\27052024_1410_Quotation.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27052024_1410_Quotation.exe"C:\Users\Admin\AppData\Local\Temp\27052024_1410_Quotation.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI16362\python311.dllFilesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31
-
memory/2884-109-0x000007FEF5960000-0x000007FEF5F48000-memory.dmpFilesize
5.9MB