Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 22:46
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20241007-en
General
-
Target
source_prepared.exe
-
Size
75.9MB
-
MD5
7bf1004db0e9aebc6d7a87f5623b873d
-
SHA1
e9ac1e9cef961b259d5dd1ccaf3d10757a3fda48
-
SHA256
83a77312cd2d5807538c6bc6055bd9533040d6ca8ed21aa4ff40e276c453f9d6
-
SHA512
abcc47540c1da0febfae5c02e24e9c912e76e1eb3be33c232d8b4798e1ef377ff19ac8907291d13cd548aff14c1d35fdb60ec0f9603003e81b9ea0b0698da92f
-
SSDEEP
1572864:B3mlIWgwm9Sk8IpG7V+VPhqSUE7WxzlK9piY4MHHLeqPNLtDNHz/3Zzeej:B2OPwm9SkB05awSAxzMAMHVLtZHL3Qej
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1280 source_prepared.exe -
resource yara_rule behavioral1/files/0x0003000000020a30-1264.dat upx behavioral1/memory/1280-1266-0x000007FEF5B70000-0x000007FEF5FDE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 584 wrote to memory of 1280 584 source_prepared.exe 31 PID 584 wrote to memory of 1280 584 source_prepared.exe 31 PID 584 wrote to memory of 1280 584 source_prepared.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:1280
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5701e2e5d0826f378a53dc5c83164c741
SHA162725dbee8546a7c9751679669c4aeb829bcb5a7
SHA2569db7ebafff20370df1ae6fc5ee98962e03fcfc02ec47abed28802191f6750dd2
SHA512df30dfba245a64f72bcf8c478d94a9902797493ce25f266fa04a0b67ad7887c8f9253404c0425285342ae771c8a44ae414887447f14d76c696f7902933367f1f