Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 18:58

General

  • Target

    Tooxan.exe

  • Size

    17.9MB

  • MD5

    6a9c9facb2db3fd0d932f53b36215b3d

  • SHA1

    2c93ccd14ef5ec09ea245dcd4d5f1c20fe58522d

  • SHA256

    b28ea8723dd87381795974301ed6077f1549fd439630f2b584f0ad30706d6d6b

  • SHA512

    3165928da6050b9eb5650098880bbf1e0815d44db8ee5e80cc545d97eb08e8e252f76896c3f9a1f9a05d3ae73c1235f0904bc780048db21a25b5238aeceab857

  • SSDEEP

    393216:senwW+eGQRJxI6pqLZE/pC1GMTozGxu8C0ibftQFUlHpUkqDR8JVUjhWkLbsmto:sSwW+e5RJqBVOpkoztZ08Q2pUkqDRu+G

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tooxan.exe
    "C:\Users\Admin\AppData\Local\Temp\Tooxan.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\Tooxan.exe
      "C:\Users\Admin\AppData\Local\Temp\Tooxan.exe"
      2⤵
      • Loads dropped DLL
      PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI20282\python312.dll

    Filesize

    6.7MB

    MD5

    48ebfefa21b480a9b0dbfc3364e1d066

    SHA1

    b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

    SHA256

    0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

    SHA512

    4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce