4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 09:42

Target

Insta.exe
Size

12.5MB
MD5

2c30f292a8d28a0e496bc8ff068e95aa
SHA1

39f45ee2f8ed727630f60878a4bd8391a7b1dbe5
SHA256

4d07a2b0ebb01f02421f61ad6bd0a931c1e1d3c8803467193e66f4a58b0b93d4
SHA512

fc09bef73f366354a206d8d33250fe8d4934d45c791e0909e2091f7f2db01f55ad0d8a888866eedec992dda481f38cdb6470b2e08f0791525220f0e6a534b445
SSDEEP

196608:3WxUHB2XJmZ7JVPvmlwlkGWRd1IS+1nZSOwJ3Y7ao5aN1a7CEfGGcXNm:3WxUhLPmlGAdeSO8Owtmgo7CEn8g

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Insta乗っ取り.exe

pid	Process
2896	Insta乗っ取り.exe

Loads dropped DLL 2 IoCs

Processes:

Insta.exeInsta乗っ取り.exe

pid	Process
1628	Insta.exe
2896	Insta乗っ取り.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Insta.exe

description	pid	Process	procid_target
PID 1628 wrote to memory of 2896	1628	Insta.exe	31
PID 1628 wrote to memory of 2896	1628	Insta.exe	31
PID 1628 wrote to memory of 2896	1628	Insta.exe	31

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_1628_133770877373756000\python312.dll

Filesize
6.6MB

MD5
166cc2f997cba5fc011820e6b46e8ea7

SHA1
d6179213afea084f02566ea190202c752286ca1f

SHA256
c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546

SHA512
49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1628_133770877373756000\Insta乗っ取り.exe

Filesize
22.1MB

MD5
cf8afc9f6cda00015343bc8f899cb295

SHA1
01c40863b71267a0b06c6703187f4647b574c2e1

SHA256
45094625308be5f3565eb9226e2963cd7ff3f94370c224f358d6143cbfe17bc7

SHA512
8a68fb7563987b637752de4dce80e536481f2a74f1a5137b5a5483520bb7c3fe61c854b4395c30df2c46ba8658f539c92aeb436c8bcabcdc6ec14a9d109d9e49

Download Submit
memory/1628-59-0x000000013F7B0000-0x0000000140453000-memory.dmp

Filesize
12.6MB

Download
memory/2896-32-0x000000013F0C0000-0x0000000140724000-memory.dmp

Filesize
22.4MB

Download