Analysis

  • max time kernel
    128s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 13:23

General

  • Target

    inv gift checker/Inv Checker V2.exe

  • Size

    9.4MB

  • MD5

    e4bdb094a6b9a0f0ec53558c61f044fd

  • SHA1

    d0caa7818bcba6b94e411e480eaa40f038c68156

  • SHA256

    2b9ffcc0f567935959cbc0265ba68414dd2d85a5d7bbb2f2e9bbc104c0b1c5bf

  • SHA512

    e7448a155bbb6963194a38e494f9e482201588874785867d04461a62e6fb24261f9bfd29b2c14a0c9d30f23cba3a1ef77eed54f4709833816a4c4263266a22b0

  • SSDEEP

    196608:XiKAFCUGA1HeT39Iigw8qQeE9TFa0Z8DOjCdyl7CES9ZXQlgKknB:y3Df1+TtIiF7Y9Z8D8Ccl7CDngyPB

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V2.exe
    "C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V2.exe
      "C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V2.exe"
      2⤵
      • Loads dropped DLL
      PID:2872
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1908
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x1d0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:460

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_MEI23042\python312.dll

            Filesize

            6.6MB

            MD5

            3c388ce47c0d9117d2a50b3fa5ac981d

            SHA1

            038484ff7460d03d1d36c23f0de4874cbaea2c48

            SHA256

            c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

            SHA512

            e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35