Resubmissions

30-07-2024 01:25

240730-bta7cs1bkq 10

30-07-2024 01:21

240730-bq5xka1akq 10

30-07-2024 01:18

240730-bn9gzazhmk 10

Analysis

  • max time kernel
    15s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    30-07-2024 01:21

General

  • Target

    DW_Reynolds_Alpha_V1.07.exe

  • Size

    62.4MB

  • MD5

    06e8ec8d1efc24b6c2701f795e908006

  • SHA1

    0e8d0a32b502261c3ab4ae838109ad9ca749bd51

  • SHA256

    9acd6adce129806682ec02315eec146bb0a6d999e43f00b4c2f8f0d60cb32cfd

  • SHA512

    984cd1aef8d1012140ae7630d53a9aa7d0bb42b098348515bc5e4f876096e64d1811e32f7a67304bdf0a566ecb8cd15682c48b5ba1bc8fc0a3ac4f838c1bc288

  • SSDEEP

    1572864:n3QtdirAH8+1osuTCSxOB6xMLiIf2qHWB75ilsZo0WX3Dxo:3kS6xjKcBa6f2qHO5iOW02zS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DW_Reynolds_Alpha_V1.07.exe
    "C:\Users\Admin\AppData\Local\Temp\DW_Reynolds_Alpha_V1.07.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Users\Admin\AppData\Local\Temp\DW_Reynolds_Alpha_V1.07.exe
      "C:\Users\Admin\AppData\Local\Temp\DW_Reynolds_Alpha_V1.07.exe"
      2⤵
      • Loads dropped DLL
      PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI13802\api-ms-win-core-file-l1-2-0.dll

    Filesize

    19KB

    MD5

    ac28edb5ad8eaa70ecbc64baf3e70bd4

    SHA1

    1a594e6cdc25a6e6be7904093f47f582e9c1fe4d

    SHA256

    fbd5e958f6efb4d78fd61ee9ee4b4d1b6f43c1210301668f654a880c65a1be86

    SHA512

    a25b812b9fa965af5f7de5552e2c2f4788a076af003ac0d94c3b2bc42dd9ab7e69af2438ce349b46a3387bf2bfcf27cec270d90ca6a44c9690861331c9e431e1

  • C:\Users\Admin\AppData\Local\Temp\_MEI13802\python311.dll

    Filesize

    5.5MB

    MD5

    387bb2c1e40bde1517f06b46313766be

    SHA1

    601f83ef61c7699652dec17edd5a45d6c20786c4

    SHA256

    0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

    SHA512

    521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

  • C:\Users\Admin\AppData\Local\Temp\_MEI13802\ucrtbase.dll

    Filesize

    1.1MB

    MD5

    988755316d0f77fc510923c2f7cd6917

    SHA1

    ccd23c30c38062c87bf730ab6933f928ee981419

    SHA256

    1854cd0f850da28835416e3b69ed6dae465df95f8d84e77adbbc001f6dbd9d78

    SHA512

    8c52210a919d9f2856f38bd6a59bbc039506650a7e30f5d100a5aa5008641707122ff79f6f88c268c9abc9f02ba2792eed6aad6a5c65891a9ce7d6d5f12c3b0a

  • \Users\Admin\AppData\Local\Temp\_MEI13802\api-ms-win-core-file-l2-1-0.dll

    Filesize

    19KB

    MD5

    b5832f1e3a18d94cd855c3d8c632b30d

    SHA1

    6315b40487078bbafb478786c42c3946647e8ef3

    SHA256

    9f096475d4ba1533f564dd4a1db5dfeb620248fe14518042094b922539dc13e3

    SHA512

    f3016ded97591e25a6d4c70d89251a331402455ab589604e55c486fec37ee8e96bd1be2d4e4e59ba102dad696b3e1f754b699f9ebe8ae462e8b958ed2d431a5b

  • \Users\Admin\AppData\Local\Temp\_MEI13802\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    19KB

    MD5

    fd59ee6be2136782225dcd86f8177239

    SHA1

    494d20e04f69676c150944e24e4fa714a3f781ca

    SHA256

    1fd044fdbc424779b01b79d477ee79dfbb508a04e86c62e1c8fc4f6d22f6a16a

    SHA512

    2250d54c3b9e6aeb2f5406e1428536564357a48ceab51596b33ff0843086fb420ad886af61725b25a58e2f50a4c17ddee10696d6041db9b60891eff8e495775c

  • \Users\Admin\AppData\Local\Temp\_MEI13802\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    19KB

    MD5

    8ff0692d32f2fcb0b417220b98f30364

    SHA1

    5eeb1d781d44e4885284c8b535f051efca64aef8

    SHA256

    53cea73c248a49389bc2da01acac1d8e8022a7e034bcd522306e43a937200897

    SHA512

    f73249f70953c537da02b890308cb18a9c6676401975bf13aeb61b1db9dfa042e908c52ee266b404948a568b23b0cfb37ecd4b80379c398c15f56ce7a82cf7a5

  • \Users\Admin\AppData\Local\Temp\_MEI13802\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    19KB

    MD5

    863ed806b4f16be984b4f1e279a1f99b

    SHA1

    b9a919216ef90064ac66b12ccde6b3bf1f334ee8

    SHA256

    171ca9df2b9ecfa545748af724c1c56ab396b299503a14c4da2197b0e5a44401

    SHA512

    fb8f195d9a1885c16aa2cc6eff38e627ea127b18978016d6046dc0120a19ab40cc4fe4b799c06f133b02f7cd6a634ae1665f05f9be5fcae609229dfaae0ce478