Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 21:50
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240508-en
General
-
Target
main.exe
-
Size
17.8MB
-
MD5
b1dc6989933eaeaaa15301309bef09c9
-
SHA1
60d4b82e80c595a78ceb7bfd86e365d96de4d03d
-
SHA256
b68f533f4708d08066454cee07227ecf32e219473b52428a94085d8cd8935497
-
SHA512
9b86d479391a5df854c8f8d45e2e59c4ba30054276befc9c181282d2cad5a4534780a1ab402f38f8492b1421f5f5a55319c956227364538ccbe79052d13fed3a
-
SSDEEP
393216:AqPnLFXlrPmQ8DOETgsvfGTgWAAvE+oxRdCg2rrTq:BPLFXNOQhEktO+uWg2G
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
main.exepid process 2576 main.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI20402\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 2040 wrote to memory of 2576 2040 main.exe main.exe PID 2040 wrote to memory of 2576 2040 main.exe main.exe PID 2040 wrote to memory of 2576 2040 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI20402\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
memory/2576-113-0x000007FEF6610000-0x000007FEF6A7E000-memory.dmpFilesize
4.4MB