Analysis
-
max time kernel
47s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 14:20
Behavioral task
behavioral1
Sample
Loader (fixed).exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Loader (fixed).exe
Resource
win10v2004-20240226-en
General
-
Target
Loader (fixed).exe
-
Size
25.5MB
-
MD5
4eed58435f6ce69470fe15197047a44f
-
SHA1
63b26f93ed45ff48519f23123ea80b463b2b2f52
-
SHA256
0e75bf7335c8e883b98a73ecb84c9252dc9eeb59b3c6173b6132c863a070cda9
-
SHA512
17d70cdb6e163a71d51185bfe86c3a6e3954f4c6d2fd5b71164050d04bffc411a402c5cd311365e1392487b3c9c1a8f4883eb46fd9553adcc96f7d61464e0d0a
-
SSDEEP
196608:SruT1Xq7n0jc/bPeNrYFJMIDJ+gsAGKpR5YQgE/96ygWZH2:lo7n0jcw8Fqy+gsi5NIr
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Loader (fixed).exepid process 2500 Loader (fixed).exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI3482\python310.dll upx behavioral1/memory/2500-48-0x000007FEF6300000-0x000007FEF676E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Loader (fixed).exedescription pid process target process PID 348 wrote to memory of 2500 348 Loader (fixed).exe Loader (fixed).exe PID 348 wrote to memory of 2500 348 Loader (fixed).exe Loader (fixed).exe PID 348 wrote to memory of 2500 348 Loader (fixed).exe Loader (fixed).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader (fixed).exe"C:\Users\Admin\AppData\Local\Temp\Loader (fixed).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\Loader (fixed).exe"C:\Users\Admin\AppData\Local\Temp\Loader (fixed).exe"2⤵
- Loads dropped DLL
PID:2500
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5196deb9a74e6e9e242f04008ea80f7d3
SHA1a54373ebad306f3e6f585bcdf1544fbdcf9c0386
SHA25620b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75
SHA5128c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68