Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-07-2024 05:07
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240709-en
General
-
Target
source_prepared.exe
-
Size
80.9MB
-
MD5
d59ea679f2426ed83f766aff300a2248
-
SHA1
71d09a8184b04a5c900013a9666e8963ef4c151f
-
SHA256
5f4d6f76d818add8fd04b0883a813618e1ff2d2be6a1643916b672c61e5d41cb
-
SHA512
89264e72e2eac230b789a53ce7eaa243d2db76f29c818afab5014b9cd7dff47b6e858c07390afc3cdcb67370a6165909722048540d62a68e4137db5b53f17ee3
-
SSDEEP
1572864:uvxZQglXEo7vaSk8IpG7V+VPhqO+ydE7UlgSiYgj+h58sMwIIKW49xqScJX0:uvxZxRleSkB05awO+ypec5k1p9xA0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
source_prepared.exepid process 2516 source_prepared.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI9882\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
source_prepared.exedescription pid process target process PID 988 wrote to memory of 2516 988 source_prepared.exe source_prepared.exe PID 988 wrote to memory of 2516 988 source_prepared.exe source_prepared.exe PID 988 wrote to memory of 2516 988 source_prepared.exe source_prepared.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2816 --field-trial-handle=1228,i,11349329556288907435,9124267341197749052,131072 /prefetch:21⤵PID:2064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 --field-trial-handle=1228,i,11349329556288907435,9124267341197749052,131072 /prefetch:81⤵PID:796
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --mojo-platform-channel-handle=3388 --field-trial-handle=1228,i,11349329556288907435,9124267341197749052,131072 /prefetch:11⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2516
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1140
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f