Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 10:04
Behavioral task
behavioral1
Sample
Resource.exe
Resource
win7-20240221-en
General
-
Target
Resource.exe
-
Size
7.4MB
-
MD5
cd56d1639c638ef44a1cbcf6756ef2ba
-
SHA1
784970f33b026fe770d8c0f8938d17b26c428327
-
SHA256
79041d419f813d07403d5ea0e190c09f63c0e9339bcf225b4588388de34aaa88
-
SHA512
c00a3be6d4cbc672b4fe3b4afb5072832a870c99d795656380e23d33e9b7b45f2d0851ba86e1d35fe502af2d001cf13e13ff6d431349dc166cfbdcc54bb19b39
-
SSDEEP
196608:qw0cDemLjv+bhqNVoBKUh8mz4Iv9Pmu1D7wJo:SieaL+9qz8/b4IsuRmo
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Resource.exepid process 2532 Resource.exe -
Processes:
resource yara_rule behavioral1/memory/2532-23-0x000007FEF55F0000-0x000007FEF5BD9000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_MEI14402\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Resource.exedescription pid process target process PID 1440 wrote to memory of 2532 1440 Resource.exe Resource.exe PID 1440 wrote to memory of 2532 1440 Resource.exe Resource.exe PID 1440 wrote to memory of 2532 1440 Resource.exe Resource.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\_MEI14402\python311.dllFilesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f
-
memory/2532-23-0x000007FEF55F0000-0x000007FEF5BD9000-memory.dmpFilesize
5.9MB