Analysis
-
max time kernel
1559s -
max time network
1573s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-07-2024 05:16
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240709-en
General
-
Target
source_prepared.exe
-
Size
80.9MB
-
MD5
d59ea679f2426ed83f766aff300a2248
-
SHA1
71d09a8184b04a5c900013a9666e8963ef4c151f
-
SHA256
5f4d6f76d818add8fd04b0883a813618e1ff2d2be6a1643916b672c61e5d41cb
-
SHA512
89264e72e2eac230b789a53ce7eaa243d2db76f29c818afab5014b9cd7dff47b6e858c07390afc3cdcb67370a6165909722048540d62a68e4137db5b53f17ee3
-
SSDEEP
1572864:uvxZQglXEo7vaSk8IpG7V+VPhqO+ydE7UlgSiYgj+h58sMwIIKW49xqScJX0:uvxZxRleSkB05awO+ypec5k1p9xA0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
source_prepared.exepid process 2336 source_prepared.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI27402\python311.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
source_prepared.exedescription pid process target process PID 2740 wrote to memory of 2336 2740 source_prepared.exe source_prepared.exe PID 2740 wrote to memory of 2336 2740 source_prepared.exe source_prepared.exe PID 2740 wrote to memory of 2336 2740 source_prepared.exe source_prepared.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2336
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f