c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed | Triage

Resubmissions

02-12-2024 01:18

241202-bpbmbsxjfq 10

02-12-2024 01:09

241202-bh6twswqbn 10

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:18

Sharing

Report Analysis Logs

General

Target

niggers.exe
Size

14.3MB
MD5

8a44ee98217bc81f0869d793eefab1f0
SHA1

4756ed10cbf5dbad09746a8fa2c2e62c2f2b7200
SHA256

c26e2475ef60ba969bb66c9b464b498efb1da0bf7360ff7545c1db3b707bdbed
SHA512

4f18f54d791929cb24c02e8865d520e6263c096bef7ebd422578bca0600cadb6ea4b046654ef007ba056bf568ff3a19b068bf4313b4a218953a5bd2ecb0e6a02
SSDEEP

393216:vOWd863huc1dQJlAwF3MnG3InVFedWm7NS/xHWgnHz:2893hr1dQ53MG4VAHsT

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

niggers.exe

pid	Process
2736	niggers.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

niggers.exe

description	pid	Process	procid_target
PID 3064 wrote to memory of 2736	3064	niggers.exe	31
PID 3064 wrote to memory of 2736	3064	niggers.exe	31
PID 3064 wrote to memory of 2736	3064	niggers.exe	31

C:\Users\Admin\AppData\Local\Temp\niggers.exe
"C:\Users\Admin\AppData\Local\Temp\niggers.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\niggers.exe
  "C:\Users\Admin\AppData\Local\Temp\niggers.exe"
  2⤵
  - Loads dropped DLL
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI30642\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit