Analysis
-
max time kernel
4s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 14:07
Behavioral task
behavioral1
Sample
executor/STARTTHIS.exe
Resource
win7-20240221-en
General
-
Target
executor/STARTTHIS.exe
-
Size
7.4MB
-
MD5
36185da0d20008184a1c6a2f842a6534
-
SHA1
c2fc45d59f0d9a3ea2ba6605d91050dd91cdf783
-
SHA256
7e4f07d1009aa7781becf6bb615908dd7e8e45c9624e09f98a1ebf10419d5b97
-
SHA512
85c4b9c3e99c9a86a0afba002b0b493d47f34c56e45525b8c4586eee095f26c38cd7c80ebc189abf8aed07f837c4c902eb759d9c8d3bfca0365bb4988d4232cd
-
SSDEEP
196608:yrtgwEsdRurErvI9pWjgaAnajMsK2+qYQ9HwZsiVtxh/:oZRurEUWjJjYDq7w1Vtxh/
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
STARTTHIS.exepid process 2732 STARTTHIS.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI23882\python312.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
STARTTHIS.exedescription pid process target process PID 2388 wrote to memory of 2732 2388 STARTTHIS.exe STARTTHIS.exe PID 2388 wrote to memory of 2732 2388 STARTTHIS.exe STARTTHIS.exe PID 2388 wrote to memory of 2732 2388 STARTTHIS.exe STARTTHIS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\executor\STARTTHIS.exe"C:\Users\Admin\AppData\Local\Temp\executor\STARTTHIS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\executor\STARTTHIS.exe"C:\Users\Admin\AppData\Local\Temp\executor\STARTTHIS.exe"2⤵
- Loads dropped DLL
PID:2732
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI23882\python312.dllFilesize
1.7MB
MD5fb8bedf8440eb432c9f3587b8114abc0
SHA1136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63
-
memory/2732-23-0x000007FEF5DE0000-0x000007FEF64A5000-memory.dmpFilesize
6.8MB