3128ef59736fdcd604698ae3d5869909e54ec1b98d8759360512855174ef8927

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

loder.exe
Size

493KB
MD5

0ae466fc76575fbc2d42cdba9788be1e
SHA1

da2adeefdd5cd64d11dfbb0c3b46e7601cb370db
SHA256

3128ef59736fdcd604698ae3d5869909e54ec1b98d8759360512855174ef8927
SHA512

315899bda601bda320c809de1ac68a7ebb00af67f3b5a229096e71d0b451c3e5693c866e2903aca604b751c6fbc963d050afc51fb9f3e1b1df19fe5de1141378
SSDEEP

6144:ZbW65hV0gp63ElxKSrsqDrQCaVtvxfYkY/IgR7G7X4xuC1eTxn1:ZbaEl4Sg4aHvxfYkP267IxuCeH

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybEePeHVnbMqQCJZqqqnT.exe	loder.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybEePeHVnbMqQCJZqqqnT.exe	loder.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
2	drive.google.com

C:\Users\Admin\AppData\Local\Temp\loder.exe
"C:\Users\Admin\AppData\Local\Temp\loder.exe"
1⤵
- Drops startup file
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x000007FEF623E000-0x000007FEF623F000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x0000000000330000-0x0000000000352000-memory.dmp

Filesize
136KB

Download
memory/2436-2-0x000007FEF5F80000-0x000007FEF691D000-memory.dmp

Filesize
9.6MB

Download
memory/2436-3-0x000007FEF5F80000-0x000007FEF691D000-memory.dmp

Filesize
9.6MB

Download
memory/2436-5-0x000007FEF5F80000-0x000007FEF691D000-memory.dmp

Filesize
9.6MB

Download
memory/2436-6-0x000007FEF5F80000-0x000007FEF691D000-memory.dmp

Filesize
9.6MB

Download
memory/2436-7-0x000007FEF5F80000-0x000007FEF691D000-memory.dmp

Filesize
9.6MB

Download
memory/2436-8-0x000007FEF623E000-0x000007FEF623F000-memory.dmp

Filesize
4KB

Download