d083223b0ea77ea48b68fe77b9625c211c861a72f04e2051d300345b52cfff00

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

11.5MB
MD5

465622298af4cdfb6b26ab4bd3466f89
SHA1

72070b793ce19746042ac1361b68ca2a15bf345f
SHA256

d083223b0ea77ea48b68fe77b9625c211c861a72f04e2051d300345b52cfff00
SHA512

07f073cbe9619bec10637340a72af8bee230ef33aed5004359ee69baf94af5e13298572ddea0a5574a7a6ae68c9f1b10a46d3be21ccc0777ff1ca7449dd2031f
SSDEEP

196608:90sUNjDEclNLkN7GA88cfcOjHpoFbrAuj/XSBlgKDQhCmisQwQhzLydILWps41BB:8NjjvLkN7GA88c0OjiFXAuWIi64wMLIJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	new.exe

Loads dropped DLL 2 IoCs

pid	Process
2504	Launcher.exe
2748	new.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2748	2504	Launcher.exe	32
PID 2504 wrote to memory of 2748	2504	Launcher.exe	32
PID 2504 wrote to memory of 2748	2504	Launcher.exe	32

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\onefile_2504_133684644845086000\new.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2504_133684644845086000\python311.dll

Filesize
5.5MB

MD5
387bb2c1e40bde1517f06b46313766be

SHA1
601f83ef61c7699652dec17edd5a45d6c20786c4

SHA256
0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

SHA512
521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2504_133684644845086000\new.exe

Filesize
17.2MB

MD5
d318db8a39ab6c884c4473ca95ca19cc

SHA1
9e06f000b9c51a17e0010f2d4d47c1e1744769f9

SHA256
9e3fe33c8cafdaf52a9f88037b3011c935082a63c308c88f964b9f9c504e47c5

SHA512
4ce7e31e29301fe9bb1cbdb015820694dbccce6950531608bae0610f808a0618978e119cec48d0bf8f2bf3f0fe93e205450b9ba1a29fac2b3134a0ccb4c42398

Download Submit