Overview
overview
10Static
static
102024 star ...pi.dll
windows7-x64
12024 star ...pi.dll
windows10-2004-x64
1FastColore...ox.dll
windows7-x64
1FastColore...ox.dll
windows10-2004-x64
1Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1Leave.exe
windows7-x64
3Leave.exe
windows10-2004-x64
10Shaakey-id...in.exe
windows7-x64
7Shaakey-id...in.exe
windows10-2004-x64
7api/CeleryIn.dll
windows7-x64
1api/CeleryIn.dll
windows10-2004-x64
1api/CeleryInject.exe
windows7-x64
1api/CeleryInject.exe
windows10-2004-x64
1bin/API.dll
windows7-x64
1bin/API.dll
windows10-2004-x64
1main.exe
windows7-x64
7main.exe
windows10-2004-x64
7Analysis
-
max time kernel
10s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 08:45
Behavioral task
behavioral1
Sample
2024 star of the night Api.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024 star of the night Api.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
FastColoredTextBox.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Guna.UI2.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Guna.UI2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Leave.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Leave.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Shaakey-idfk12-09d89e6/main.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Shaakey-idfk12-09d89e6/main.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
api/CeleryIn.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
api/CeleryIn.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
api/CeleryInject.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
api/CeleryInject.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
bin/API.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
bin/API.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
main.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
main.exe
Resource
win10v2004-20240802-en
General
-
Target
Shaakey-idfk12-09d89e6/main.exe
-
Size
22.3MB
-
MD5
01d47112d18f6fbac82ca624446c4979
-
SHA1
7e9158e9a09995e9381f3e6349bc827f8216910d
-
SHA256
8f793075f2fdd4dc2a4ef27b275c4efd83a5a8ef64295c40dc92b8dbaac71279
-
SHA512
9d8743578c336a13279b6af709ba7e73ed4236ebb0634c9df0c6228b9f164cf73d06898eedd0a9310ef1fb14686b2b893833167f1a4b21db963d07a8ca31c2d4
-
SSDEEP
393216:Wqil0KbTLzUj/TwsIs0DLSPB0MgNb3W7PBuhxJWjSHHax4:mlRze6+PB01lEZoCSHF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2052 main.exe -
Loads dropped DLL 2 IoCs
pid Process 1956 main.exe 2052 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2052 1956 main.exe 30 PID 1956 wrote to memory of 2052 1956 main.exe 30 PID 1956 wrote to memory of 2052 1956 main.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shaakey-idfk12-09d89e6\main.exe"C:\Users\Admin\AppData\Local\Temp\Shaakey-idfk12-09d89e6\main.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\onefile_1956_133707771930518000\main.exeC:\Users\Admin\AppData\Local\Temp\Shaakey-idfk12-09d89e6\main.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3