badc92fc3b900d25ae7552956298aec99270bd339087cffe03ec251cf74778bc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 16:47

Target

ColorBotWaloranti.exe
Size

14.1MB
MD5

03e85d213f7da865cda0803202b63948
SHA1

543436410eec2d5d070568ab19940f4b85acc7b1
SHA256

badc92fc3b900d25ae7552956298aec99270bd339087cffe03ec251cf74778bc
SHA512

4517d314585a7f037e35b93c36cb48ac859f757dfb10b09818135dc7d397d2b11a9f9bb31c403c79151ff0871d8a75ab91c2451c71040b644658091fd6acbd39
SSDEEP

393216:hqPuYXJEf/m3phqm7QfXCOpuHSe5wX79iAv:IPuYXJEfKhqjPQSlRL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2696	ColorBotWaloranti.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4d7-89.dat	upx
behavioral1/memory/2696-91-0x000007FEF60F0000-0x000007FEF655F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2696	2172	ColorBotWaloranti.exe	30
PID 2172 wrote to memory of 2696	2172	ColorBotWaloranti.exe	30
PID 2172 wrote to memory of 2696	2172	ColorBotWaloranti.exe	30

C:\Users\Admin\AppData\Local\Temp\ColorBotWaloranti.exe
"C:\Users\Admin\AppData\Local\Temp\ColorBotWaloranti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\ColorBotWaloranti.exe
  "C:\Users\Admin\AppData\Local\Temp\ColorBotWaloranti.exe"
  2⤵
  - Loads dropped DLL
  PID:2696

C:\Users\Admin\AppData\Local\Temp\_MEI21722\python310.dll

Filesize
1.5MB

MD5
fd06363dde36c2a936fa551cac2e9a02

SHA1
832464285b0ea7e08f8a82b0beea17c213b89d76

SHA256
aa8225957264a0e04d219105fb7313a09ea536978ae23479649a3f81a110e976

SHA512
3df9b8a8ebe7d3232cedec043aa31e761470152b1a88c1bb0a4c6f484a96579c05faecbfa2e9d123b68ac905fe1e78fd2df78435172e524c3010aa8ac8438cbc

Download Submit
memory/2696-91-0x000007FEF60F0000-0x000007FEF655F000-memory.dmp

Filesize
4.4MB

Download