Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 18:43
Behavioral task
behavioral1
Sample
release.exe
Resource
win7-20240419-en
General
-
Target
release.exe
-
Size
5.9MB
-
MD5
6d46969ab9ba73f9c14cb57c8911f492
-
SHA1
f65f0a1aa15eaec933b320fd0f6bdc59535f6d28
-
SHA256
2edfd48c7fc7f707fe235d05551b61a882296b5b9097e79823219bc0cde8f90a
-
SHA512
f93a65d80ca72813e0381e4c014e7f1ac913e1cdff652ce0fa1511cf24c87e33d2011ff6b05fe3f65341355c7c20704196bd4510f5357bf40a079dc1abf8ea82
-
SSDEEP
98304:WrOVmoDUN43WlaEjjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aBn4:WrOVumWzOjmFwDRxtYSHdK34kdai7bNp
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
release.exepid process 2772 release.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI9922\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
release.exedescription pid process target process PID 992 wrote to memory of 2772 992 release.exe release.exe PID 992 wrote to memory of 2772 992 release.exe release.exe PID 992 wrote to memory of 2772 992 release.exe release.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI9922\python310.dllFilesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
-
memory/2772-23-0x000007FEF5730000-0x000007FEF5B96000-memory.dmpFilesize
4.4MB