63140f2969ad933c29b49af1b6f39888781d278dffc6ffb38551b5f8e58f9f38 | Triage

Resubmissions

03/10/2024, 12:02

241003-n7zhbsxekk 7

03/10/2024, 12:02

241003-n7pccs1djc 7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 12:02

Sharing

Report Analysis Logs

General

Target

CFG.exe
Size

8.3MB
MD5

b2a3ee6796bf379834424227b26dc4a7
SHA1

60305307311b2bda94ac1fda1307068410f724e2
SHA256

63140f2969ad933c29b49af1b6f39888781d278dffc6ffb38551b5f8e58f9f38
SHA512

fce98a8b3962a2dfb945a63a0ecfa1cc53427775fdd9982e10a541505ed3969b54cac6200658e977ea7f9c6454092a40a3f368011d42eb004112ebb9b1f3c2e2
SSDEEP

196608:Z5Ek++ixdQmRJ8dA6l7aycBIGpEGo6hTOv+QKffSX:3EkMdQusl29foWOv+9ff0

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2116	CFG.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2116	1660	CFG.exe	28
PID 1660 wrote to memory of 2116	1660	CFG.exe	28
PID 1660 wrote to memory of 2116	1660	CFG.exe	28

C:\Users\Admin\AppData\Local\Temp\CFG.exe
"C:\Users\Admin\AppData\Local\Temp\CFG.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\CFG.exe
  "C:\Users\Admin\AppData\Local\Temp\CFG.exe"
  2⤵
  - Loads dropped DLL
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16602\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit