Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
d14d.dll.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d14d.dll.exe
Resource
win10v2004-20241007-en
General
-
Target
d14d.dll.exe
-
Size
34.2MB
-
MD5
01038e9cc6cdbe8a9c3e7af574b9dfc9
-
SHA1
97422c3ed35c167df4b10885508f8b1ace7cdfb4
-
SHA256
cd7e762aa31fecae08ef0b371abb7c38f2f4778faf60a688c11ade2a606080c3
-
SHA512
5f6d7300cb78941a8eae0110699aead763b6667af0ae6e0f896a15e44019b7ffe18f5b9b26e9762591ec050bad8e4723c9e0007460ed13c06ab9a7418f7e1a48
-
SSDEEP
786432:n7Bdb+QJbTiumfSXdZESWqE9XZ60elByrr5Lo:ntdFxTivfS4qiLrrJo
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2912 d14d.dll.exe -
resource yara_rule behavioral1/files/0x0003000000020833-823.dat upx behavioral1/memory/2912-825-0x000007FEF60F0000-0x000007FEF67B5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2912 2188 d14d.dll.exe 31 PID 2188 wrote to memory of 2912 2188 d14d.dll.exe 31 PID 2188 wrote to memory of 2912 2188 d14d.dll.exe 31
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5ca67f0baf3cc3b7dbb545cda57ba3d81
SHA15b4e36aef877307af8a8f78f3054d068d1a9ce89
SHA256f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3
SHA512a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7
-
C:\Users\Admin\AppData\Local\Temp\_MEI21882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI21882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Filesize1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1