Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 21:39
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20241007-en
General
-
Target
main.exe
-
Size
17.9MB
-
MD5
f85c7a5aefdbe7c85ee6363991904589
-
SHA1
f28ef5fe2d534049a8c4a8f981b8599e2532d901
-
SHA256
d6852ef7536374c41c97e5a440ed05457bab1f05dd8e89964bc020ed8b5af74e
-
SHA512
e542a4f07408864dffdb397035b3948cd9243627dea2346d496d4dd7eeb7df47151bc11f2374edda91f6db90c674b0a9c698b409bf7c3378037f2d333091ad04
-
SSDEEP
393216:EqPnLFXlrzQMDOETgsvfGKRgdM2mvEaQNRWtKtqo:lPLFXNzQREBc5TTW7o
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
main.exepid process 2796 main.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI15522\python310.dll upx behavioral1/memory/2796-114-0x000007FEF6580000-0x000007FEF69EE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
main.exedescription pid process target process PID 1552 wrote to memory of 2796 1552 main.exe main.exe PID 1552 wrote to memory of 2796 1552 main.exe main.exe PID 1552 wrote to memory of 2796 1552 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378