e2c9484eedd028bdd863963490363fd99d3de4ddff2fc1c9a0a84f4f03183752

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 10:14

Target

Insta.exe
Size

12.5MB
MD5

d4bdcc7d36db91a0d7da0090a9e496ea
SHA1

3acfed1d1c2fe455730c4c9a28aa995f58ed0c3a
SHA256

e2c9484eedd028bdd863963490363fd99d3de4ddff2fc1c9a0a84f4f03183752
SHA512

dedd4833f339db297c45e981c5947324d9a0790aa4e635e421af599ea48a2ae9a8517c7898b81e54301fe2720e67281914e26b12d52a5d5ca5ecc1790d12b844
SSDEEP

393216:ZquJcYgQtQTwkH2OXZia78V4IyrXwJD9lta:Z7cYfPVOXcA2VyrkZls

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Insta乗っ取り.exe

pid	Process
2892	Insta乗っ取り.exe

Loads dropped DLL 2 IoCs

Processes:

Insta.exeInsta乗っ取り.exe

pid	Process
2144	Insta.exe
2892	Insta乗っ取り.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Insta.exe

description	pid	Process	procid_target
PID 2144 wrote to memory of 2892	2144	Insta.exe	31
PID 2144 wrote to memory of 2892	2144	Insta.exe	31
PID 2144 wrote to memory of 2892	2144	Insta.exe	31

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_2144_133770896864154000\python312.dll

Filesize
6.6MB

MD5
166cc2f997cba5fc011820e6b46e8ea7

SHA1
d6179213afea084f02566ea190202c752286ca1f

SHA256
c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

SHA512
49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2144_133770896864154000\Insta乗っ取り.exe

Filesize
22.1MB

MD5
898a20ff8e499d451c6a6b5a55cf8f53

SHA1
64646b8db0fb3dcd74625410f2888863c803ef35

SHA256
b2d286f737a5bb4a095ec89672c3849e8bc93dc9b1f7d441e6d9f56565a662b3

SHA512
eaa617ce6186d1aa189278f234bbfb7ab8fbfbf188779c535242da501d94b4aeb6e1b3f64b0a316cf52160abab21c7779662944a1d859fc8b6105eef0b738a2b

Download Submit
memory/2144-59-0x000000013F200000-0x000000013FEA4000-memory.dmp

Filesize
12.6MB

Download
memory/2892-31-0x000000013F320000-0x0000000140987000-memory.dmp

Filesize
22.4MB

Download