Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 11:11

General

  • Target

    Plague.exe

  • Size

    10.4MB

  • MD5

    46bf5978a632f7ffd438ab8c96d758d7

  • SHA1

    82e94d104bb4a9b80cefe43b6ff52daa25f316b3

  • SHA256

    c4f26de64bbd6828ed5776e9492e21abf83b084794ed6f784c8eeafcaa61e1c6

  • SHA512

    9357717b41ccfaf35ed22c5418ebc8237858f033c6a162230f0784b315f9c93133a0e109465eb41e3159a8e44c42274b075b4e044036229f803e399289d27afc

  • SSDEEP

    196608:ctxEkYcowuLIoBA1HeT39Iigwh1ncKOVVtc97XEtQ1NjOp4U:MEkYcXIq1+TtIiFv0VQx060l

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Plague.exe
    "C:\Users\Admin\AppData\Local\Temp\Plague.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Users\Admin\AppData\Local\Temp\Plague.exe
      "C:\Users\Admin\AppData\Local\Temp\Plague.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI27282\python312.dll

    Filesize

    6.6MB

    MD5

    d521654d889666a0bc753320f071ef60

    SHA1

    5fd9b90c5d0527e53c199f94bad540c1e0985db6

    SHA256

    21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2

    SHA512

    7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3