Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 08:16
Behavioral task
behavioral1
Sample
Undress.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Undress.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Undress.exe
Resource
win10v2004-20240508-en
General
-
Target
Undress.exe
-
Size
25.0MB
-
MD5
38699df24048fba05b33984d57b34098
-
SHA1
9a6089bb96a7331d02405c981b7677546ce552c1
-
SHA256
a17725beb8751b47466d60d3bb73432e29f74286f1c37b8e6ec49fb759cc8da5
-
SHA512
cc8094caeac2452af80104ec0c6f8ce508db44e2dc4b7ad201387f9b0759379bfbba9b659bee764737b8e898729f885dd0ca95e924f39363494e8f8e49eedaec
-
SSDEEP
196608:/rYFP9VQurErvI9pWjgfPvzm6gsFEB4Au:GlGurEUWjC3zDb84Au
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Undress.exepid process 3068 Undress.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI15042\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Undress.exedescription pid process target process PID 1504 wrote to memory of 3068 1504 Undress.exe Undress.exe PID 1504 wrote to memory of 3068 1504 Undress.exe Undress.exe PID 1504 wrote to memory of 3068 1504 Undress.exe Undress.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311