Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 11:11
Behavioral task
behavioral1
Sample
Plague.exe
Resource
win7-20240221-en
General
-
Target
Plague.exe
-
Size
10.4MB
-
MD5
46bf5978a632f7ffd438ab8c96d758d7
-
SHA1
82e94d104bb4a9b80cefe43b6ff52daa25f316b3
-
SHA256
c4f26de64bbd6828ed5776e9492e21abf83b084794ed6f784c8eeafcaa61e1c6
-
SHA512
9357717b41ccfaf35ed22c5418ebc8237858f033c6a162230f0784b315f9c93133a0e109465eb41e3159a8e44c42274b075b4e044036229f803e399289d27afc
-
SSDEEP
196608:ctxEkYcowuLIoBA1HeT39Iigwh1ncKOVVtc97XEtQ1NjOp4U:MEkYcXIq1+TtIiFv0VQx060l
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Plague.exepid process 2572 Plague.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Plague.exepid process 2572 Plague.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Plague.exedescription pid process target process PID 2728 wrote to memory of 2572 2728 Plague.exe Plague.exe PID 2728 wrote to memory of 2572 2728 Plague.exe Plague.exe PID 2728 wrote to memory of 2572 2728 Plague.exe Plague.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Plague.exe"C:\Users\Admin\AppData\Local\Temp\Plague.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Plague.exe"C:\Users\Admin\AppData\Local\Temp\Plague.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3