Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 21:39
Behavioral task
behavioral1
Sample
sillyboost_cracked_v1/crack.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sillyboost_cracked_v1/crack.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
sillyboost_cracked_v1/loader.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
sillyboost_cracked_v1/loader.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
sillyboost_cracked_v1/silly.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
sillyboost_cracked_v1/silly.exe
Resource
win10v2004-20240426-en
General
-
Target
sillyboost_cracked_v1/silly.exe
-
Size
31.7MB
-
MD5
edf5231904acc98d0aa6e8dac9e6f57b
-
SHA1
ab01505afc25fd2286fcc52a52a12c510b298fa4
-
SHA256
4400e10819840cbbe5238f4cb4560ec2c5fa6dbfca6124d6065aa8df42506472
-
SHA512
b4e01b5e2756fae3f7872d909bcb1e26618c6713d5428af6c96d08613154f65e749840ee07c3d6ce42af974a2c6c87b2bcd90e494e2e61722a377982b7070291
-
SSDEEP
786432:EYSoQBHU9SuW1HMqG5qkOIRFbRBYvHjwouTtRLzx:EYSoQBD/NMqpk9FdKfjQtNx
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
silly.exepid process 2208 silly.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI28162\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
silly.exedescription pid process target process PID 2816 wrote to memory of 2208 2816 silly.exe silly.exe PID 2816 wrote to memory of 2208 2816 silly.exe silly.exe PID 2816 wrote to memory of 2208 2816 silly.exe silly.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"2⤵
- Loads dropped DLL
PID:2208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python311.dllFilesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
memory/2208-24-0x000007FEF59E0000-0x000007FEF5FC9000-memory.dmpFilesize
5.9MB