1617e37bcd27307fa0992c8865eb91d8ef4d7a642132abe74ea5b46af7f648bd

Analysis

max time kernel
52s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

7.5MB
MD5

598f72402d65a23e0d3cf3b62dc7f8d8
SHA1

4171fce35a5add0b3036ff9fb9ef3ef5961d7b81
SHA256

1904a9b7fcab0323088596c84e47f11d4f9c1852ba32790be46886efe9f43cc8
SHA512

8cb8a8bd72884d89e0907b090bb39f9f784509c7f6ee2c5912985fe0c253d0db031e40abeb65d0a277fde7b508795dfb81782f43434eb4234250f9d677e28c80
SSDEEP

196608:DqunqZkwfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSm:FeIH2XgHq+jq93YoH

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2208	Loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019667-21.dat	upx
behavioral1/memory/2208-23-0x000007FEF67C0000-0x000007FEF6E82000-memory.dmp	upx

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1632	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE
Token: 33	2648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2648	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe
1632	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	vlc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2208	848	Loader.exe	28
PID 848 wrote to memory of 2208	848	Loader.exe	28
PID 848 wrote to memory of 2208	848	Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2208

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RegisterDeny.m4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI8482\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/1632-57-0x000007FEFB290000-0x000007FEFB2C4000-memory.dmp

Filesize
208KB

Download
memory/1632-56-0x000000013F630000-0x000000013F728000-memory.dmp

Filesize
992KB

Download
memory/1632-58-0x000007FEF6B50000-0x000007FEF6E06000-memory.dmp

Filesize
2.7MB

Download
memory/1632-59-0x000007FEF4F00000-0x000007FEF5FB0000-memory.dmp

Filesize
16.7MB

Download
memory/2208-23-0x000007FEF67C0000-0x000007FEF6E82000-memory.dmp

Filesize
6.8MB

Download