83949939b15fcbadf97a450bc6da3cda873030076d05837d05815f7a655178e1

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-it
resource tags

arch:x64arch:x86image:win7-20240708-itlocale:it-itos:windows7-x64systemwindows
submitted
29-08-2024 09:33

Target

exile/ragnarok.exe
Size

21.1MB
MD5

1efc43508fc572195ff35160ae8b7ff7
SHA1

c80ce813a543b0a57608d774e371395bd88aa68e
SHA256

d9b81d87564cbd606f2d35b64b89da2066772c2f79f292fc1fc5e39cdbb3da6d
SHA512

e5d1df6e0e440afe6aabbf0bdac70e52178901cbb4e9be45b56b27570fd05a892f3ce792f068f4ce56b141cc06c90ff82f77f95e5f723aaa55f299b3f7c88fcb
SSDEEP

393216:EqPnLFXl03kQvyR0CRiGh0AgfdEjA0eQUTN6i21Ox9u8:lPLFX1QvyP0AKdFQsNq1Oxh

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2772	ragnarok.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4f6-136.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2772	2704	ragnarok.exe	30
PID 2704 wrote to memory of 2772	2704	ragnarok.exe	30
PID 2704 wrote to memory of 2772	2704	ragnarok.exe	30

C:\Users\Admin\AppData\Local\Temp\exile\ragnarok.exe
"C:\Users\Admin\AppData\Local\Temp\exile\ragnarok.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\exile\ragnarok.exe
  "C:\Users\Admin\AppData\Local\Temp\exile\ragnarok.exe"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Users\Admin\AppData\Local\Temp\_MEI27042\python310.dll

Filesize
1.4MB

MD5
99cb804abc9a8f4cb8d08d77e515dcb7

SHA1
0d833cb729f3d5c845491b61b47018c82065f4ad

SHA256
8d23914f6eaa371f2e0c15816c7ab62573d428e750d1bbcd9a07498264d7d240

SHA512
43252d45803957ba79d42afdd12b956c3b829c9b00a78199c35e3eeb863d8c56f4f0b467faae227b7c058f59a3f11152f670090e2212eb6a2837378bca53ac82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27042\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
memory/2772-138-0x000007FEF6140000-0x000007FEF65A4000-memory.dmp

Filesize
4.4MB

Download