Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 16:27
Behavioral task
behavioral1
Sample
OptiFabric.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
OptiFabric.exe
Resource
win10v2004-20240802-en
General
-
Target
OptiFabric.exe
-
Size
80.8MB
-
MD5
91f45fe3581950e170c846bfc8502673
-
SHA1
ba8ef585be7aee1a06dfe869c4552bfe59b85cb4
-
SHA256
1330fca7e5727fac774fd5331db10460e435c36433f02b24146fd046e284479c
-
SHA512
11663db611e85d919006670e8e2d5f15a06f1f933d9b025ed9c7f44d9b66506cee4109ada591d4bb78071003b24a689a47d6609cfdebbb34968535427f64e02b
-
SSDEEP
1572864:fvxZQglX2c7vaSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlW69xqScJX0:fvxZxRXeSkB05awb+Tfe25FST9xA0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
OptiFabric.exepid process 2264 OptiFabric.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI24482\python311.dll upx behavioral1/memory/2264-1262-0x000007FEF5EC0000-0x000007FEF64A9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
OptiFabric.exedescription pid process target process PID 2448 wrote to memory of 2264 2448 OptiFabric.exe OptiFabric.exe PID 2448 wrote to memory of 2264 2448 OptiFabric.exe OptiFabric.exe PID 2448 wrote to memory of 2264 2448 OptiFabric.exe OptiFabric.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD58ea69ca2292c3af9cdb46dded91bc837
SHA172de7df68b2c336720d1528c34f21ff00ed7a2ce
SHA2563512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49
SHA512fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc