Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 13:27
Behavioral task
behavioral1
Sample
Netflix.0.0.2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Netflix.0.0.2a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
;�.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
;�.pyc
Resource
win10v2004-20240508-en
General
-
Target
Netflix.0.0.2a.exe
-
Size
7.3MB
-
MD5
6f7f545fa57062c3a3f5ea5cb7980424
-
SHA1
751944eef210f2f8af056157df8a33300d73c79a
-
SHA256
23ff78d9dc8496b1e861b7627cdee9d1c0374c526981d1f241b61666d47daf5c
-
SHA512
5286dcbce3277420cf4610dc6e6816113c417fe9695bb4d4f0c7ce2a07b530c48c8ea652d710b20b497ecb0486fed5065b62066cc8e49017ac45636868236f10
-
SSDEEP
196608:YpYS6YzOshoKMuIkhVastRL5Di3u41D7dJ2:sYSVzOshouIkPftRL54VRD2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Netflix.0.0.2a.exepid process 2604 Netflix.0.0.2a.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI28922\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Netflix.0.0.2a.exedescription pid process target process PID 2892 wrote to memory of 2604 2892 Netflix.0.0.2a.exe Netflix.0.0.2a.exe PID 2892 wrote to memory of 2604 2892 Netflix.0.0.2a.exe Netflix.0.0.2a.exe PID 2892 wrote to memory of 2604 2892 Netflix.0.0.2a.exe Netflix.0.0.2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Netflix.0.0.2a.exe"C:\Users\Admin\AppData\Local\Temp\Netflix.0.0.2a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\Netflix.0.0.2a.exe"C:\Users\Admin\AppData\Local\Temp\Netflix.0.0.2a.exe"2⤵
- Loads dropped DLL
PID:2604
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI28922\python311.dllFilesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
memory/2604-23-0x000007FEF5240000-0x000007FEF5829000-memory.dmpFilesize
5.9MB