Resubmissions

12-12-2024 15:34

241212-szwtpaykhv 10

12-12-2024 15:12

241212-sk9f8sznfj 10

12-12-2024 03:03

241212-dj9y2sykfs 10

11-12-2024 08:54

241211-kt1axsznhq 10

08-12-2024 15:39

241208-s3rzxaspbk 10

Analysis

  • max time kernel
    5s
  • max time network
    1s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2024 15:39

General

  • Target

    Nuke Tool discord-gg-kasyno.exe

  • Size

    42.5MB

  • MD5

    51817b9dcd9c193c3358f6b179d268d1

  • SHA1

    48711e49dd33723c12a2ba925d228b99ab297274

  • SHA256

    eacbb5f16c8e1315bfa69d3bb0ce318cf246cff642bbde43e6263fd34e0c399b

  • SHA512

    6a5b1ac87137fe7ced1c902ee331d2eaf38a6d042b836190abd1a6a9f3826e1141c86ab64557992e7c388278f81f8abd04e60027e790cad8713c374f920f6957

  • SSDEEP

    786432:gDEDi+G9pN2TxKFLyPnoVIXkXVGRG7dcuZaqdior4XXpf6q3loaU/fsc+KkeAhev:ggDi+RoFLyPno/AydcucZfb3KnqKUhev

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nuke Tool discord-gg-kasyno.exe
    "C:\Users\Admin\AppData\Local\Temp\Nuke Tool discord-gg-kasyno.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\Nuke Tool discord-gg-kasyno.exe
      "C:\Users\Admin\AppData\Local\Temp\Nuke Tool discord-gg-kasyno.exe"
      2⤵
      • Loads dropped DLL
      PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI23162\python310.dll

    Filesize

    1.4MB

    MD5

    4a6afa2200b1918c413d511c5a3c041c

    SHA1

    39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

    SHA256

    bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

    SHA512

    dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

  • memory/2832-24-0x000007FEF6680000-0x000007FEF6AE6000-memory.dmp

    Filesize

    4.4MB