5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d

Resubmissions

28-10-2024 21:25

28-10-2024 19:40

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:40

Target

serverside.xyz external.exe
Size

6.0MB
MD5

5a991ec34d988f0646119a2f858f28f4
SHA1

53fc617b72823a5b63a69281926eef07b4371912
SHA256

5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d
SHA512

2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab
SSDEEP

98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1852	serverside.xyz external.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001903d-21.dat	upx
behavioral1/memory/1852-23-0x000007FEF6240000-0x000007FEF66AE000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	serverside.xyz external.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1852	2792	serverside.xyz external.exe	28
PID 2792 wrote to memory of 1852	2792	serverside.xyz external.exe	28
PID 2792 wrote to memory of 1852	2792	serverside.xyz external.exe	28

C:\Users\Admin\AppData\Local\Temp\serverside.xyz external.exe
"C:\Users\Admin\AppData\Local\Temp\serverside.xyz external.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\serverside.xyz external.exe
  "C:\Users\Admin\AppData\Local\Temp\serverside.xyz external.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1852

C:\Users\Admin\AppData\Local\Temp\_MEI27922\python310.dll

Filesize
1.4MB

MD5
01988415e8fb076dcb4a0d0639b680d9

SHA1
91b40cffcfc892924ed59dc0664c527ff9d3f69c

SHA256
b101db1ddd659b8d8ffd8b26422fde848d5b7846e0c236f051fadb9412de6e24

SHA512
eab0c3ca4578751a671beb3da650b5e971a79798deb77472e42f43aa2bea7434ad5228a8fddbfff051ce05054dbf3422d418f42c80bc3640e0e4f43a0cf2ebbe

Download Submit
memory/1852-23-0x000007FEF6240000-0x000007FEF66AE000-memory.dmp

Filesize
4.4MB

Download
memory/1852-24-0x000007FEF6240000-0x000007FEF66AE000-memory.dmp

Filesize
4.4MB

Download