a05bfbe6d72fdb7bbf2d3fc4cae634f319c1e90f746bb49338833b6f5ed5c221 | Triage

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 00:59

Sharing

Report Analysis Logs

General

Target

Botlobby.exe
Size

14.4MB
MD5

a7d3b205c86fe21a3032d9a63429be23
SHA1

018202c85fbcb56dd35b2383cad728d48de2fff6
SHA256

b7853963eea3ed2d67761d6b6319b9e83318ffcf554fd91d9ac62ce0fa37cc86
SHA512

6d7d6cd9475d501a873d2b38dc6311c2bb66f91c365eb6d874e4bf444e1210c668bfcc8e1826501b27671aeb8301d0ee8135f12ec7fb73b8d18f509d9a9786ed
SSDEEP

393216:kiIE7YoPQJidQuslSq99oWOv+9fg9aIQjAG:97rPQwdQuSDorvSY9a5A

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2564	Botlobby.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2564	2476	Botlobby.exe	28
PID 2476 wrote to memory of 2564	2476	Botlobby.exe	28
PID 2476 wrote to memory of 2564	2476	Botlobby.exe	28

C:\Users\Admin\AppData\Local\Temp\Botlobby.exe
"C:\Users\Admin\AppData\Local\Temp\Botlobby.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\Botlobby.exe
  "C:\Users\Admin\AppData\Local\Temp\Botlobby.exe"
  2⤵
  - Loads dropped DLL
  PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24762\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit