0b44463127fa27ad7f210577187ab6f1f76bed775bfc3221fb40ed21d12502d6

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddos/loader.exe
Size

5.3MB
MD5

448ccbb16a4b84ed50457089c4d85c20
SHA1

aedc3ef0636d759dcff01560ad158e10801912c4
SHA256

15fbb2aca01aa435afdc91636155a56e46ffe3749a00f58c600c6863c576c001
SHA512

c9457f0b3fc7840763a22e7bbd9a85bda38e7b89b318ff8435cf2343e72ea3936ad39d55b9060e5945af68198ccf0dec1efb7b3063deaa6aef40245a28257fcd
SSDEEP

98304:baSlkXdBUF2NQV6K1eiTzW14Cmov0GtmfYb6d+2ss0FBNcFlQOyyqg7:ba/tNeRVCIgmAud+/s0FsFPyyn7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2516	loader.exe

Loads dropped DLL 2 IoCs

pid	Process
2684	loader.exe
2516	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2516	2684	loader.exe	31
PID 2684 wrote to memory of 2516	2684	loader.exe	31
PID 2684 wrote to memory of 2516	2684	loader.exe	31

C:\Users\Admin\AppData\Local\Temp\ddos\loader.exe
"C:\Users\Admin\AppData\Local\Temp\ddos\loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\onefile_2684_133651058869078000\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\ddos\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2684_133651058869078000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2684_133651058869078000\loader.exe

Filesize
8.5MB

MD5
a96b4994900a84ba901d9a6ac12584d5

SHA1
cce0a845a1e776459498cce63c21c0af34c40713

SHA256
6b7e7db37868242586319272d8e80bf51bfeab34e26676f03b49fb99341a6c0d

SHA512
e2cd3673ab018d4d91d61b6dabd1e55c920dbef4c26e658839e71fa88040292cb618eb9a89f3757db91aed806ffdee3ad195990b7362fbf970836751b5cd2930

Download Submit