8a78fdf56fe352e39b804faa5f544db35694ea6d0d46297d52bb66986604ab15 | Triage

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 07:53

Sharing

Report Analysis Logs

General

Target

ANDROID RAT/Build 1.exe
Size

8.1MB
MD5

de516eb29dbf7dfc4fad6ece9b0006d2
SHA1

ab14d37b175dbc956c057c6f82040661740270f5
SHA256

3cd0aa003daac31a45fc62b54024afe108bfad2288667e9b8a1ce3530ee1b489
SHA512

60996d7f729bef43825e72ba9b2c53c1d681cf0e4ca58a009075d656addb4a9151ff46b1671cd12e8e7703c15557fe32083be8b392c9797e4b7930bbdf196ddd
SSDEEP

196608:K+0MhCeBTX1QFhjwt25HnuOpPOf+NIqAkL:jlAOOHuOOWuq

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2980	Build 1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2980	1684	Build 1.exe	30
PID 1684 wrote to memory of 2980	1684	Build 1.exe	30
PID 1684 wrote to memory of 2980	1684	Build 1.exe	30

C:\Users\Admin\AppData\Local\Temp\ANDROID RAT\Build 1.exe
"C:\Users\Admin\AppData\Local\Temp\ANDROID RAT\Build 1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\ANDROID RAT\Build 1.exe
  "C:\Users\Admin\AppData\Local\Temp\ANDROID RAT\Build 1.exe"
  2⤵
  - Loads dropped DLL
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16842\python39.dll

Filesize
4.3MB

MD5
088904a7f5b53107db42e15827e3af98

SHA1
1768e7fb1685410e188f663f5b259710f597e543

SHA256
3761c232e151e9ceaf6c7d37b68da3df1962e3106e425cc3937d1f60170f3718

SHA512
c5edc25fd9a37673f769af1a1fd540b41e68351bc30b44bc83a1d0d4a8fb078888bbb31173a77ef47698631c9816bc05637b499c20d63e3d65457d9aa4bc2c6b

Download Submit