Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 02:14
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240226-en
General
-
Target
main.exe
-
Size
17.6MB
-
MD5
4049d2031e509b2526e40566998bfa19
-
SHA1
b46130fac5874edc987b244e529e3ee1d8789c70
-
SHA256
8d6dc041a543f9f12f67831cc2a8e765b1bf9b67492af33161a91592f563c5d4
-
SHA512
a48e654746ee1997279ebb8e2028ae2ba27f9ff311479c2a3ba481ac508fd30c7bdd3699c78bf0fd6bfe3f370bf66889a37509ee1d9cc11e9bd988af3833c11b
-
SSDEEP
393216:AqPnLFXlrPmQ8DOETgsvfGxgKhNobvEJmbc3JLjq:BPLFXNOQhEIdoAEg3Y
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
main.exepid process 628 main.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22002\python310.dll upx behavioral1/memory/628-113-0x000007FEF61D0000-0x000007FEF663E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 2200 wrote to memory of 628 2200 main.exe main.exe PID 2200 wrote to memory of 628 2200 main.exe main.exe PID 2200 wrote to memory of 628 2200 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI22002\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
memory/628-113-0x000007FEF61D0000-0x000007FEF663E000-memory.dmpFilesize
4.4MB