Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 00:54
Behavioral task
behavioral1
Sample
FnPuller.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
FnPuller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FnPuller.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FnPuller.pyc
Resource
win10v2004-20241007-en
General
-
Target
FnPuller.exe
-
Size
16.4MB
-
MD5
bedc28d5ba8af8459f85d57a8b3b9f9a
-
SHA1
a2eefb7bda74ad01cef606390593a1ebfc2e1709
-
SHA256
db0d623ba3e20c740268c11638f22a96d9a4453dc8f1dc54839da993cca59abd
-
SHA512
726d98ee61ad7108bb0d82217bb9ac392e3279204bc1a83c01c9c4c6fd119861ee387820d9c0f03b7d7762f742b60dd562185ebbf29926c687d06e190d8516eb
-
SSDEEP
196608:E0NpUXDB2Mi0sKYu/PaQZXGnOrzGsyHHICEB6yBC+K6kHWMbgdOLv0zGil64ofxI:MXoQZXGOrzGseICEBRB8RD07DofTESV
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
FnPuller.exepid process 2832 FnPuller.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI24162\python310.dll upx behavioral1/memory/2832-102-0x000007FEF60F0000-0x000007FEF6556000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
FnPuller.exedescription pid process target process PID 2416 wrote to memory of 2832 2416 FnPuller.exe FnPuller.exe PID 2416 wrote to memory of 2832 2416 FnPuller.exe FnPuller.exe PID 2416 wrote to memory of 2832 2416 FnPuller.exe FnPuller.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"2⤵
- Loads dropped DLL
PID:2832
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:316
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5f88ce4e677e2fae8e465111349e3ab15
SHA1d6c4f7283c4d949af2cf9eedd756f3f625cc400d
SHA2560c404b474c574ce4aa301b6a2528643e0008bf6ec0a3db5b8b436f1cca51ad04
SHA51258ebf534c38ceb26813c9c588d74050688a1ca75bb4d66a45eeea34942fd0352a846796e3eafd8bd9c483a194dd6aa62dad7c10bd3830cb60b5a8345e559e1f2