c2286e00d5caf5be214acc4bb392b8b0aedc32a26b3f33ab7f4ed199ff12f27b | Triage

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 14:13

Sharing

Report Analysis Logs

General

Target

cashsploit-bootstrapper.exe
Size

102.7MB
MD5

cba252b22181ee18074c62682c90d7d1
SHA1

944fcbcb7bb592954ebbabb9bd83e524dea90ad7
SHA256

c2286e00d5caf5be214acc4bb392b8b0aedc32a26b3f33ab7f4ed199ff12f27b
SHA512

08da2f637bffadcf1453bf95c91e00d73db648b53ad2e582372d686b7f2c366a6b9ad243657a4e4cb225309cc9d3750703098c0bab0132a538668233a7f4f6e3
SSDEEP

3145728:tnG7r7rS6xjKcBanL2qHO5iVAunGQbRe0zJcBTRZ2:gHnSWNaBHCin1XcBO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1820	cashsploit-bootstrapper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1820	1268	cashsploit-bootstrapper.exe	31
PID 1268 wrote to memory of 1820	1268	cashsploit-bootstrapper.exe	31
PID 1268 wrote to memory of 1820	1268	cashsploit-bootstrapper.exe	31

C:\Users\Admin\AppData\Local\Temp\cashsploit-bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\cashsploit-bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\cashsploit-bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\cashsploit-bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:1820

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI12682\python312.dll

Filesize
6.6MB

MD5
b243d61f4248909bc721674d70a633de

SHA1
1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc

SHA256
93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7

SHA512
10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb

Download Submit