Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 15:35
Behavioral task
behavioral1
Sample
New folder/main.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
New folder/main.exe
Resource
win10v2004-20240802-en
General
-
Target
New folder/main.exe
-
Size
17.8MB
-
MD5
d2f1e43cf79329555884dbea81482cf3
-
SHA1
1b4ad4dd8a88013bb64121b5980573701c22eaa9
-
SHA256
59946d06786bfff6beac0e8e17976999fd55fc366a04adc82fa389aae363d96b
-
SHA512
7702bda9970c9246ebd797f5b97b9786b91242c2d21dcdd86b6ff379c56b79b058953ed96a2c710f7cdf6ad212db4c99a08793009db89df8e2aeb5ef380d7957
-
SSDEEP
393216:3qPnLFXlryQ8DOETgsvfGrgMHvEbLUoSW8Jzq:6PLFXNyQhEapsbCWN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2904 main.exe -
resource yara_rule behavioral1/files/0x000500000001c585-111.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2904 2404 main.exe 30 PID 2404 wrote to memory of 2904 2404 main.exe 30 PID 2404 wrote to memory of 2904 2404 main.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\New folder\main.exe"C:\Users\Admin\AppData\Local\Temp\New folder\main.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\New folder\main.exe"C:\Users\Admin\AppData\Local\Temp\New folder\main.exe"2⤵
- Loads dropped DLL
PID:2904
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378