Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 12:11
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
General
-
Target
Built.exe
-
Size
6.9MB
-
MD5
9b2e25fadf053ab865b4cb3e61d03b0e
-
SHA1
c094322abb571ed75a60f497c40cc1bb4ce136c4
-
SHA256
09a58b851daf87c259a3bf9016486d114b8676592bee5fa004e28dffd2f31957
-
SHA512
819b5c21bb5303b5b7284e883869e00f722464b7968ad994f435dc6bea76980e35be46db9c2781a24635d38497a0a26c650201bebe4f686e3724ab6ead4ac177
-
SSDEEP
98304:o1DjWM8JEE1rFxamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFK:o101MeNTfm/pf+xk4dWRptrbWOjgrt
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2896 Built.exe -
resource yara_rule behavioral1/files/0x00050000000187a5-21.dat upx behavioral1/memory/2896-23-0x000007FEF6660000-0x000007FEF6C48000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 Built.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2896 2540 Built.exe 30 PID 2540 wrote to memory of 2896 2540 Built.exe 30 PID 2540 wrote to memory of 2896 2540 Built.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31