Analysis

  • max time kernel
    1563s
  • max time network
    1565s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 00:58

General

  • Target

    FnPuller.exe

  • Size

    16.4MB

  • MD5

    bedc28d5ba8af8459f85d57a8b3b9f9a

  • SHA1

    a2eefb7bda74ad01cef606390593a1ebfc2e1709

  • SHA256

    db0d623ba3e20c740268c11638f22a96d9a4453dc8f1dc54839da993cca59abd

  • SHA512

    726d98ee61ad7108bb0d82217bb9ac392e3279204bc1a83c01c9c4c6fd119861ee387820d9c0f03b7d7762f742b60dd562185ebbf29926c687d06e190d8516eb

  • SSDEEP

    196608:E0NpUXDB2Mi0sKYu/PaQZXGnOrzGsyHHICEB6yBC+K6kHWMbgdOLv0zGil64ofxI:MXoQZXGOrzGseICEBRB8RD07DofTESV

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FnPuller.exe
    "C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\FnPuller.exe
      "C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"
      2⤵
      • Loads dropped DLL
      PID:2704
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2888

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI13922\python310.dll

      Filesize

      1.4MB

      MD5

      f88ce4e677e2fae8e465111349e3ab15

      SHA1

      d6c4f7283c4d949af2cf9eedd756f3f625cc400d

      SHA256

      0c404b474c574ce4aa301b6a2528643e0008bf6ec0a3db5b8b436f1cca51ad04

      SHA512

      58ebf534c38ceb26813c9c588d74050688a1ca75bb4d66a45eeea34942fd0352a846796e3eafd8bd9c483a194dd6aa62dad7c10bd3830cb60b5a8345e559e1f2

    • memory/2704-102-0x000007FEF5D90000-0x000007FEF61F6000-memory.dmp

      Filesize

      4.4MB