Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 16:35
Behavioral task
behavioral1
Sample
SonicX/SonicX.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SonicX/SonicX.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
SonicX/SonicX.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SonicX/SonicX.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SonicX/Vurnability.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
SonicX/Vurnability.dll
Resource
win10v2004-20240508-en
General
-
Target
SonicX/SonicX.exe
-
Size
5.9MB
-
MD5
38a115b41e35e5dcb341a6e445cb1dfe
-
SHA1
fa320754186beaca0ba664c3df85dd075c936d43
-
SHA256
8a1d56f85b8f68ae8a3c1a11ca252036106234b6923656718e5175992fdfd536
-
SHA512
3b89091482494c94f50e0104045d03eb542d38cb438a81a8057701b68239673552fcfff9e64c8e437dec5f7bb2e7e4c48d3d78704e7873467379ac22c6c1c5db
-
SSDEEP
98304:CrInld9hjki65sn6Wfz7pnxC/tEC8smLhsl9Qvr/kAXjzrgyOSsJRynM6iIskrls:CrInr9cDOYyCREhS0kypnFnM6TsCsnUK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
SonicX.exepid process 2576 SonicX.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI22282\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SonicX.exedescription pid process target process PID 2228 wrote to memory of 2576 2228 SonicX.exe SonicX.exe PID 2228 wrote to memory of 2576 2228 SonicX.exe SonicX.exe PID 2228 wrote to memory of 2576 2228 SonicX.exe SonicX.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"2⤵
- Loads dropped DLL
PID:2576
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI22282\python310.dllFilesize
1.4MB
MD5617c7f358a7744fa767ef52e5224c9ec
SHA16b8974308c1a734a5cfab590205d5135c216c54d
SHA25667ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA51225d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b
-
memory/2576-23-0x000007FEF5B80000-0x000007FEF5FE3000-memory.dmpFilesize
4.4MB