954729e3ee0bd5cb33f3c8fdbc8f7e7cbe886eb7b809f9292d812cff398d48f1 | Triage

Analysis

max time kernel
20s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:22

Sharing

Report Analysis Logs

General

Target

Neverdies.cc.exe
Size

14.4MB
MD5

4a7e31f21d2ad053af1b62535b9b8b88
SHA1

499c99baa624d8c6bfa567de7bbe55e1862bbb12
SHA256

954729e3ee0bd5cb33f3c8fdbc8f7e7cbe886eb7b809f9292d812cff398d48f1
SHA512

78a3a41f1b65ef66f9efaf82c1918b7bbc7ab3d2370541851003359bbd55df23ae5898f47469783173cd31bdb85c871b28394736233a62b7897d6840e2ac785d
SSDEEP

393216:kEkZQrdQuslSq99oWOv+9fgwuk49Dudy3h:khQrdQuSDorvSYwukgu4h

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2488	Neverdies.cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2488	1804	Neverdies.cc.exe	28
PID 1804 wrote to memory of 2488	1804	Neverdies.cc.exe	28
PID 1804 wrote to memory of 2488	1804	Neverdies.cc.exe	28

C:\Users\Admin\AppData\Local\Temp\Neverdies.cc.exe
"C:\Users\Admin\AppData\Local\Temp\Neverdies.cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\Neverdies.cc.exe
  "C:\Users\Admin\AppData\Local\Temp\Neverdies.cc.exe"
  2⤵
  - Loads dropped DLL
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI18042\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit