b8a1e46ef14be22cfa81ffe3ed1ed5bbcb7b976d0ddaae57e842123699ac7bfe | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 08:48

Sharing

Report Analysis Logs

General

Target

pluto/files/emailbomber3.exe
Size

6.6MB
MD5

0ceb1ca34c14b2e71e22e022f24afbe5
SHA1

521e9d8a60c5959bb199a568b5ba4069f219308a
SHA256

bb09957553ef2a16165553594c45edc2ec90ddc194d97189071fc0f9635796c8
SHA512

4c1123b4a09688661c60aa05c75281811254ddd77f962f1820044e395a813740450eba3e44adac4fce31293040d7c3e4e898299046db1bbd016cb8596d58ff01
SSDEEP

196608:QZ5BASL2Vmd6+DBnNgwQ+dtLZ7kNHCq/hUpe69:aHL2Vmd6mNNjd7WHCNe6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2640	emailbomber3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2640	3040	emailbomber3.exe	29
PID 3040 wrote to memory of 2640	3040	emailbomber3.exe	29
PID 3040 wrote to memory of 2640	3040	emailbomber3.exe	29

C:\Users\Admin\AppData\Local\Temp\pluto\files\emailbomber3.exe
"C:\Users\Admin\AppData\Local\Temp\pluto\files\emailbomber3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\pluto\files\emailbomber3.exe
  "C:\Users\Admin\AppData\Local\Temp\pluto\files\emailbomber3.exe"
  2⤵
  - Loads dropped DLL
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30402\python310.dll

Filesize
4.2MB

MD5
a1185bef38fdba5e3fe6a71f93a9d142

SHA1
e2b40f5e518ad000002b239a84c153fdc35df4eb

SHA256
8d0bec69554317ccf1796c505d749d5c9f3be74ccbfce1d9e4d5fe64a536ae9e

SHA512
cb9baea9b483b9153efe2f453d6ac0f0846b140e465d07244f651c946900bfcd768a6b4c0c335ecebb45810bf08b7324501ea22b40cc7061b2f2bb98ed7897f4

Download Submit