Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 18:08
Behavioral task
behavioral1
Sample
Astral1.85.0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Astral1.85.0.exe
Resource
win10v2004-20241007-en
General
-
Target
Astral1.85.0.exe
-
Size
7.6MB
-
MD5
f3b348e40bb1b63b692e319240641bba
-
SHA1
37419d110626e30856ce9c0c314e40c03fb53030
-
SHA256
0cf6909a41cd63f98297dde6be0493e984037271de520ee2b4993574255fa173
-
SHA512
6808e4ee60236734d1c20d2b26c2b912faf1f3328638e2bbed514081948f253778edd67ab2687de3b4566455a8b5d32e94c58bce5de0cc100d159b90319e9990
-
SSDEEP
196608:FRHY9WwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jw:4IHziK1piXLGVE4Ue0VJk
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2212 Astral1.85.0.exe -
resource yara_rule behavioral1/files/0x00050000000194e6-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2212 2420 Astral1.85.0.exe 30 PID 2420 wrote to memory of 2212 2420 Astral1.85.0.exe 30 PID 2420 wrote to memory of 2212 2420 Astral1.85.0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Astral1.85.0.exe"C:\Users\Admin\AppData\Local\Temp\Astral1.85.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Astral1.85.0.exe"C:\Users\Admin\AppData\Local\Temp\Astral1.85.0.exe"2⤵
- Loads dropped DLL
PID:2212
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56ef5d2f77064df6f2f47af7ee4d44f0f
SHA10003946454b107874aa31839d41edcda1c77b0af
SHA256ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367
SHA5121662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266