4541b6437ea08c7fa890b11d01dce587d7061a2c2c737c5daeed57721e71aa6a | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 06:51

Sharing

Report Analysis Logs

General

Target

Renicail/renicail_menu.exe
Size

16.6MB
MD5

1e242ecb3a0bd6a3bbb510cdf4b2250c
SHA1

9bde576d012509aaf8e3febe6fe2a1ab21f6437d
SHA256

cf6257d55f51e99a4f7a5cacd0a611dda670fcb38c7779fd32615efab2dcf824
SHA512

b002270faaf5fd2065c973768353031b7f808af23949f0e1a03121b96c63b93a46ff4be735ebd3929f76f0ff2dfa29e765205c5e205d0990316591b6abc73414
SSDEEP

393216:hu7L/pxgQ2aUX47d4arXsS8RzdChdjaK1:hCLBqQ2aUI7d4arXsS0KaK

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2724	renicail_menu.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2724	3060	renicail_menu.exe	30
PID 3060 wrote to memory of 2724	3060	renicail_menu.exe	30
PID 3060 wrote to memory of 2724	3060	renicail_menu.exe	30

C:\Users\Admin\AppData\Local\Temp\Renicail\renicail_menu.exe
"C:\Users\Admin\AppData\Local\Temp\Renicail\renicail_menu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\Renicail\renicail_menu.exe
  "C:\Users\Admin\AppData\Local\Temp\Renicail\renicail_menu.exe"
  2⤵
  - Loads dropped DLL
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30602\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit