Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 15:17
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240508-en
General
-
Target
Loader.exe
-
Size
12.1MB
-
MD5
be541590b256e77780bbad1e932accde
-
SHA1
e9bc9cab5fce4c5840c840b0296cff2bcbca41cf
-
SHA256
7a217c82459cd9a3d6e190410f511e1c534a6fd19d32f3c5f47baf6c02d807dc
-
SHA512
70c14058e21a9599892afe0054ae302d362e55d0b78ba2d7b68426dc22567d4c6288c4f446aa4fce18c811c7e12ee357c02f3a0f7581588f5bdde5efd8bbf852
-
SSDEEP
196608:kmJXyrAQq4Hg9x84FMIZETSwjPePdrQJYQTLBpzH2gYx99Fitn2P3k/qf:psA8Hg9qQETSwvJYibB2Hw5/2
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
Loader.exepid process 1080 Loader.exe 1080 Loader.exe 1080 Loader.exe 1080 Loader.exe 1080 Loader.exe 1080 Loader.exe 1080 Loader.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Loader.exedescription pid process target process PID 2280 wrote to memory of 1080 2280 Loader.exe Loader.exe PID 2280 wrote to memory of 1080 2280 Loader.exe Loader.exe PID 2280 wrote to memory of 1080 2280 Loader.exe Loader.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\api-ms-win-core-file-l1-2-0.dllFilesize
22KB
MD58d1531275b769c1bd485440214bfaf82
SHA1c8bb901b148522595cd78f1e12f61730bfa3d9df
SHA2560b7a730b6b10c9d2e2fe1b9b4419b1fc60db9074a0c6f830e1b2da4d0f65fe88
SHA51255914f424c400208b0d2c4d6cafa355aecf4697d3a6bf4032fe298214ed3565013c969b1e23d91cdf995dad46760c80e3a0a3abc062b3084b2bb4bc83a90995f
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\api-ms-win-core-file-l2-1-0.dllFilesize
22KB
MD550d07886dd9136e8da57bfde8fa1f69c
SHA117526cd01e870d4087c5aa423e4971c72882e173
SHA25667fd0522cacfc3f5fb90373dd5fb388b6f63035d9a380cac4a3dd3d7801724ed
SHA5127d1b12529f35e1bcd7a858fef4001a4a5e0ff15506789fb3ce56b58427d16c32a9c1768b87b2f66a1b37456a05f8e05ae0b0eddfb4335ae0cb8eda00550175c0
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\api-ms-win-core-localization-l1-2-0.dllFilesize
22KB
MD5ab169047e1a0fcf3c98be20b451cb13e
SHA1a286836c85ae43ed5c79b9875f97abdadf57b560
SHA2563cbc6f8cc2a014c9c6e87ca05dd0e9e0884da58afdc53b589b3d7172c4403ed7
SHA512c8e27ebd9335f7f34919e841f9834fa687f822d4289b47c20283e37f4a499008668bafd12e1f742597a6c8623312fc41881c18a56b9062a2a609dbb55f0cd17c
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\api-ms-win-core-processthreads-l1-1-1.dllFilesize
22KB
MD55132f7fe729791081561426904d45e76
SHA156fba2baed4123bf4be7be1c5344f95e6bd9db9c
SHA256a5aa6755860602c58c0edb1353c965e6f0ba58e7276ba6fb5a0b961fb274d125
SHA512b12e981ddb608049456dbfc0bb77350819f42caf0da457ad778bb9ded3979503ce6713d366547ac3f949ebdc01d0775da1d726fd367b11b8680a472017f59cc6
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\api-ms-win-core-timezone-l1-1-0.dllFilesize
22KB
MD51ee744ceca8da8dba0dc27f25125242c
SHA14c168b8673cfabbbbcf00195cf0db7b640a0289f
SHA256c67dd8ed74c0a207c980caa6bb453e62180a71af175feeb42c2c926ecb911e0a
SHA512d17b8f1419e3f77729c686d4fe79feb08368953e0997ef67217e829456e1c13dde5d9e7a0c35d117d1ae4d40f37e160cb6390b45242c0308d809dfdadb3155f9
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\faker\providers\job\es_MX\__init__.pyFilesize
83B
MD5eeaa6ca5cb7f4bb1d7e75797f9b5af37
SHA10ac3743facacbc2090930b41cf38bcfe2951eb37
SHA256ce99db30f577944104a7365372ea8363cd9d0087a6e9d88f7b835a1926da336c
SHA512b492e6fa3eb607683a6c6f5696835aeae5e4c12fd2d44346bfd954d25c0bcf5bda808c175b0b17e26a0d5daf4f91d8588de119f5b747a80b3cfe53f68bbecd7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\python311.dllFilesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
C:\Users\Admin\AppData\Local\Temp\_MEI22802\ucrtbase.dllFilesize
1.1MB
MD528146c66076a266e93956111981cad4e
SHA144797bab4d3d3a8ccdb9df3a519cd3dbef838c31
SHA256ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da
SHA512078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85