Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 13:32
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
zitmain.py
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
zitmain.py
Resource
win10v2004-20240508-en
General
-
Target
main.exe
-
Size
17.8MB
-
MD5
aa4926dc51737b4ce2215cf9bc366092
-
SHA1
5ef032d3fc81a9afaefc916e503e54aa09b2525e
-
SHA256
eec326a602c970184613785546e3560739ec824e48cb3011130209531811b5ba
-
SHA512
4a8f430d44d80b1f136909c5504b26054386895cab4b91767cc53b8d4990dd9549928913148844dab7c04ad5944181608f0ff6aa53a248602a08668ed6d0af91
-
SSDEEP
393216:lqPnLFXlrPmQ8DOETgsvfGFughg3AJFPvEePb/yoxq:cPLFXNOQhELQg3AHUC/k
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
main.exepid process 1544 main.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI21762\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 2176 wrote to memory of 1544 2176 main.exe main.exe PID 2176 wrote to memory of 1544 2176 main.exe main.exe PID 2176 wrote to memory of 1544 2176 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI21762\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
memory/1544-113-0x000007FEF5E70000-0x000007FEF62DE000-memory.dmpFilesize
4.4MB