b89c8fb7d60e1ad1593a0f8f71f0ff8627f4cd7cdca0ad816cf88f17e36fa159 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 20:55

Sharing

Report Analysis Logs

General

Target

listenlittlenigger.exe
Size

6.7MB
MD5

42bd70076cbd6bf784ab995852146824
SHA1

e0f1e831775736e856f5325f546c3638f6112775
SHA256

b89c8fb7d60e1ad1593a0f8f71f0ff8627f4cd7cdca0ad816cf88f17e36fa159
SHA512

61b4a3e526e84280df3a26b2d8e7cef969dd45f32f6e857f62e9e2b01b355d22da9430807ab1515b2a4be6c7ef2d4b5520d2c3cc8a5c0152595b9a91c3c38f54
SSDEEP

196608:QsjpAN/kWDGXtGzICteEroxzlxZV3Gu5D4S26/CS3HxTM9:Jj6buGzInErot14S26nxY9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1148	listenlittlenigger.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1148	2848	listenlittlenigger.exe	31
PID 2848 wrote to memory of 1148	2848	listenlittlenigger.exe	31
PID 2848 wrote to memory of 1148	2848	listenlittlenigger.exe	31

C:\Users\Admin\AppData\Local\Temp\listenlittlenigger.exe
"C:\Users\Admin\AppData\Local\Temp\listenlittlenigger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\listenlittlenigger.exe
  "C:\Users\Admin\AppData\Local\Temp\listenlittlenigger.exe"
  2⤵
  - Loads dropped DLL
  PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28482\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit