Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 10:32
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240802-en
General
-
Target
source_prepared.exe
-
Size
77.1MB
-
MD5
c630bfc590d34139bce713a9f588173d
-
SHA1
6c63c331bd54db755a1a1342b2b89b1ffde6f3a8
-
SHA256
5d7b8fccb2dd56566c6b72ff868264c605eee3175ac30eb0214146db1ced86eb
-
SHA512
a2819599c97b349912a7a0b1b6f3c0c047598c16980ca31cef487c10bbae591108b291769b7ce4ddf88b328863f5319be40de6d0750f76808a802e6f529836df
-
SSDEEP
1572864:BvhQ6lNWeoC7vDSk8IpG7V+VPhqqg5NbE7W8ylPj4iY4MHHLeqPNLtDaoRZrvGH:Bvh1f1oCPSkB05awBzx8y5nMHVLteQ9U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
source_prepared.exepid Process 2848 source_prepared.exe -
Processes:
resource yara_rule behavioral1/files/0x0003000000020af1-1262.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
source_prepared.exedescription pid Process procid_target PID 2776 wrote to memory of 2848 2776 source_prepared.exe 30 PID 2776 wrote to memory of 2848 2776 source_prepared.exe 30 PID 2776 wrote to memory of 2848 2776 source_prepared.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2848
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5933b49da4d229294aad0c6a805ad2d71
SHA19828e3ce504151c2f933173ef810202d405510a4
SHA256ab3e996db016ba87004a3c4227313a86919ff6195eb4b03ac1ce523f126f2206
SHA5126023188f3b412dd12c2d4f3a8e279dcace945b6e24e1f6bbd4e49a5d2939528620ceb9a5f77b9a47d2d0454e472e2999240b81bed0239e7e400a4e25c96e1165