c65bb019b27ce608df2aa415c0cb32cecf7d3297b84f232301b426e2fa98dbe7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PLHybrid/PLHybrid/PLHybrid.exe
Size

27.1MB
MD5

a51b6a6481af98ff4746cffad95975f3
SHA1

4de062d5539541287495ccdf5e36e4c4883569cc
SHA256

4285ac6bbd4001b9c3f716ddf06b173f9a32a5e897f694e4374407e009be86d3
SHA512

93d9703d3817ad58b4f308b2ecced197dd016924c23157faa5837ae35e721030be1cf993fdff173c9aae1b4b1dde362f5a534eea6f6dcae43e3e93b0fe701ec1
SSDEEP

786432:qCmwTPZ6Ihu64lNpRI/bRseECP/xob6TQtVLwvJ/jksKm:GGP4X6qpm1seHHxottVgJ77Km

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3068	main.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	PLHybrid.exe
3068	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3068	2860	PLHybrid.exe	31
PID 2860 wrote to memory of 3068	2860	PLHybrid.exe	31
PID 2860 wrote to memory of 3068	2860	PLHybrid.exe	31

C:\Users\Admin\AppData\Local\Temp\PLHybrid\PLHybrid\PLHybrid.exe
"C:\Users\Admin\AppData\Local\Temp\PLHybrid\PLHybrid\PLHybrid.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\onefile_2860_133714025946462000\main.exe
  C:\Users\Admin\AppData\Local\Temp\PLHybrid\PLHybrid\PLHybrid.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2860_133714025946462000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit