Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 13:58
Behavioral task
behavioral1
Sample
DISCORDNUKERBYKLOWZYY.exe
Resource
win7-20240708-en
General
-
Target
DISCORDNUKERBYKLOWZYY.exe
-
Size
19.5MB
-
MD5
3b74622cb80575e2fd54acce44b7e133
-
SHA1
9890e867697ae8fd5e35543c3ac257cf03065606
-
SHA256
39c4afc796f6730ec8da841d1aec05f2c3e87424952f6e85049a98f66edea31c
-
SHA512
46e8a33ca55d3e10b95054fad61e3ef0ae21c68932e115c45c16d6126d88a9e6cbc8e2701d7f37e11815671427abb863137ce5b3909534c1a04260b2a987bca6
-
SSDEEP
393216:hqPnLFXlrFrpQQ6DOETgsvfGYgDGAvmkCbaBIIOdWgk:IPLFXNFrpQQrEROTn/Od
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1944 DISCORDNUKERBYKLOWZYY.exe -
resource yara_rule behavioral1/files/0x000500000001c83f-122.dat upx behavioral1/memory/1944-124-0x000007FEF6950000-0x000007FEF6DBE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1944 2344 DISCORDNUKERBYKLOWZYY.exe 30 PID 2344 wrote to memory of 1944 2344 DISCORDNUKERBYKLOWZYY.exe 30 PID 2344 wrote to memory of 1944 2344 DISCORDNUKERBYKLOWZYY.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\DISCORDNUKERBYKLOWZYY.exe"C:\Users\Admin\AppData\Local\Temp\DISCORDNUKERBYKLOWZYY.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\DISCORDNUKERBYKLOWZYY.exe"C:\Users\Admin\AppData\Local\Temp\DISCORDNUKERBYKLOWZYY.exe"2⤵
- Loads dropped DLL
PID:1944
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378