Analysis
-
max time kernel
839s -
max time network
840s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 21:25
Behavioral task
behavioral1
Sample
Driver.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
FNknoxV1.exe
Resource
win7-20240611-en
Behavioral task
behavioral3
Sample
FNknoxV1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
mciavi32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
spwizimg.dll
Resource
win10v2004-20240508-en
General
-
Target
FNknoxV1.exe
-
Size
7.0MB
-
MD5
127d96c8d795e8420ee8e1e178b6dfe9
-
SHA1
e8db8d8577ac74a60de1afb5350b63fa8e49d045
-
SHA256
2ecbcb10d1027d3c8b3288d6d73010163631e3f578fe0d3ab996400dd9474e06
-
SHA512
f98eb6fdb763b0ab062a4a3f1d2a17fade1fd8e937bbd34f2c3fed8bd50de1dae57f75c0c67b533b09d6e86cf35fcc0bf8a6755103f0a76dcc7ea63f315acbe1
-
SSDEEP
98304:OwzdbM+Q2y+aq0AANDhjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbiEJ1nL2hBnP:OGf0AKpOjmFQR4MVGFtwLPsnL2hV/H
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
FNknoxV1.exepid process 2636 FNknoxV1.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI20002\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
FNknoxV1.exedescription pid process target process PID 2000 wrote to memory of 2636 2000 FNknoxV1.exe FNknoxV1.exe PID 2000 wrote to memory of 2636 2000 FNknoxV1.exe FNknoxV1.exe PID 2000 wrote to memory of 2636 2000 FNknoxV1.exe FNknoxV1.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD59e985651962ccbccdf5220f6617b444f
SHA19238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA2563373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA5128b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36