Analysis
-
max time kernel
41s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20231129-it -
resource tags
arch:x64arch:x86image:win7-20231129-itlocale:it-itos:windows7-x64systemwindows -
submitted
03-06-2024 13:22
Behavioral task
behavioral1
Sample
marlbot-1.6.0-nextmortal.exe
Resource
win7-20231129-it
Behavioral task
behavioral2
Sample
marlbot-1.6.0-nextmortal.exe
Resource
win10v2004-20240508-it
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20240221-it
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20240508-it
General
-
Target
marlbot-1.6.0-nextmortal.exe
-
Size
275.8MB
-
MD5
b90626e3f49f7c46beea15aaf68c4679
-
SHA1
7b807310e273e951f6a93f8d07ab1ce59f91f363
-
SHA256
446c75b51f0d9a5d5c32b48a6aad1cd8466ab349d201854854db8d18237a7173
-
SHA512
bf6c2b4dba4dd290a977ab01abc638ca7a80cbfadfa1ea613f212101160c1f6d547e622e81b962e9873fc91a049f34e5b78c4e371554bf87532a19c896814dc8
-
SSDEEP
6291456:V3WtLdzR6TNcmYVO2HCihdp/70Mmd10tqbeqSWqDeH1WjOvAjO:VQLdIzf6dpjmdOtqbeqlVWjOYj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
marlbot-1.6.0-nextmortal.exepid Process 1524 marlbot-1.6.0-nextmortal.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
marlbot-1.6.0-nextmortal.exedescription pid Process procid_target PID 2684 wrote to memory of 1524 2684 marlbot-1.6.0-nextmortal.exe 29 PID 2684 wrote to memory of 1524 2684 marlbot-1.6.0-nextmortal.exe 29 PID 2684 wrote to memory of 1524 2684 marlbot-1.6.0-nextmortal.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"C:\Users\Admin\AppData\Local\Temp\marlbot-1.6.0-nextmortal.exe"2⤵
- Loads dropped DLL
PID:1524
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1412
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
38B
MD554a7946252f28e14598915be3050508e
SHA18c456681871f607004826b8b1fc9588aba0bc337
SHA256b04fb4aaf5e74d8e629432aec768d9ba4371ce4791f86da6941a79b2cd9be329
SHA51201e264aa91128e202dd2505e5b55f359c1082056b41ce2c85470b368b14475db7b3fea3391a0aeda56dcc218489de8a33fd0a36cca4507399fc8ae7978e0c792