Analysis

  • max time kernel
    41s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20231129-it
  • resource tags

    arch:x64arch:x86image:win7-20231129-itlocale:it-itos:windows7-x64systemwindows
  • submitted
    03-06-2024 13:22

General

  • Target

    marlbot-1.6.0-nextmortal.exe

  • Size

    275.8MB

  • MD5

    b90626e3f49f7c46beea15aaf68c4679

  • SHA1

    7b807310e273e951f6a93f8d07ab1ce59f91f363

  • SHA256

    446c75b51f0d9a5d5c32b48a6aad1cd8466ab349d201854854db8d18237a7173

  • SHA512

    bf6c2b4dba4dd290a977ab01abc638ca7a80cbfadfa1ea613f212101160c1f6d547e622e81b962e9873fc91a049f34e5b78c4e371554bf87532a19c896814dc8

  • SSDEEP

    6291456:V3WtLdzR6TNcmYVO2HCihdp/70Mmd10tqbeqSWqDeH1WjOvAjO:VQLdIzf6dpjmdOtqbeqlVWjOYj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe
    "C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe
      "C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"
      2⤵
      • Loads dropped DLL
      PID:1524
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI26842\python311.dll

      Filesize

      5.5MB

      MD5

      9a24c8c35e4ac4b1597124c1dcbebe0f

      SHA1

      f59782a4923a30118b97e01a7f8db69b92d8382a

      SHA256

      a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

      SHA512

      9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

    • C:\Users\Admin\AppData\Local\Temp\_MEI26842\torch\ao\nn\quantizable\__init__.py

      Filesize

      38B

      MD5

      54a7946252f28e14598915be3050508e

      SHA1

      8c456681871f607004826b8b1fc9588aba0bc337

      SHA256

      b04fb4aaf5e74d8e629432aec768d9ba4371ce4791f86da6941a79b2cd9be329

      SHA512

      01e264aa91128e202dd2505e5b55f359c1082056b41ce2c85470b368b14475db7b3fea3391a0aeda56dcc218489de8a33fd0a36cca4507399fc8ae7978e0c792