Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 09:25
Behavioral task
behavioral1
Sample
ExternalC823KFKALZ2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
ExternalC823KFKALZ2.exe
Resource
win7-20240508-en
General
-
Target
ExternalC823KFKALZ2.exe
-
Size
25.0MB
-
MD5
2aaab42dbd52db19256e06aee0cdfa53
-
SHA1
139f71f294b861453a67aba561db5a878ce7c206
-
SHA256
788f19958bc2384eef4de6adb109671bc3f02cc782bd5737594a7847109cf006
-
SHA512
9b8460697848018ce96158b25a08354540017af82ae790ffc903bfcd77a9ec9e2a0e82caf188a4dd1b54ca8569ce6349cca253d6c858dd05974252faaccc7e08
-
SSDEEP
98304:/rgaDjWM8JEE1rnbamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEg:/rga0ueNTfm/pf+xk4dWRGtrbWOjgWya
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ExternalC823KFKALZ2.exepid process 2644 ExternalC823KFKALZ2.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22322\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ExternalC823KFKALZ2.exedescription pid process target process PID 2232 wrote to memory of 2644 2232 ExternalC823KFKALZ2.exe ExternalC823KFKALZ2.exe PID 2232 wrote to memory of 2644 2232 ExternalC823KFKALZ2.exe ExternalC823KFKALZ2.exe PID 2232 wrote to memory of 2644 2232 ExternalC823KFKALZ2.exe ExternalC823KFKALZ2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExternalC823KFKALZ2.exe"C:\Users\Admin\AppData\Local\Temp\ExternalC823KFKALZ2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\ExternalC823KFKALZ2.exe"C:\Users\Admin\AppData\Local\Temp\ExternalC823KFKALZ2.exe"2⤵
- Loads dropped DLL
PID:2644
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI22322\python311.dllFilesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31
-
memory/2644-23-0x000007FEF5B80000-0x000007FEF6168000-memory.dmpFilesize
5.9MB