Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 18:43
Behavioral task
behavioral1
Sample
release/main/cheat.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
release/main/cheat.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
release/main/loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
release/main/loader.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
release/map/map.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
release/map/map.exe
Resource
win10v2004-20240611-en
General
-
Target
release/map/map.exe
-
Size
7.3MB
-
MD5
4165131d7bed66d69a2467e21842d0b3
-
SHA1
57255f830038d18161089681f43b3c01501bd155
-
SHA256
bcb9ba98165906ab0cf5d60f7c3397fcbe73ff5904b512c59dbeeca6f25b8b47
-
SHA512
de3a459ff83144b1c060d6a37942327e92b8b9633839595cc65998c36f920dec298d8af932b1c8efa6c81f90f83be74b12ec47e992974168538d0ac39ad666fc
-
SSDEEP
196608:s2YS6yoOshoKMuIkhVastRL5Di3uh1D7JK:1YSroOshouIkPftRL54YRJK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
map.exepid process 2204 map.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI16802\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
map.exedescription pid process target process PID 1680 wrote to memory of 2204 1680 map.exe map.exe PID 1680 wrote to memory of 2204 1680 map.exe map.exe PID 1680 wrote to memory of 2204 1680 map.exe map.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"C:\Users\Admin\AppData\Local\Temp\release\map\map.exe"2⤵
- Loads dropped DLL
PID:2204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI16802\python311.dllFilesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
memory/2204-23-0x000007FEF54F0000-0x000007FEF5AD9000-memory.dmpFilesize
5.9MB