Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2024 15:14

General

  • Target

    49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283.exe

  • Size

    10.7MB

  • MD5

    cd463d16cf57c3a9f5c9588a878a7213

  • SHA1

    ef22c2b11efc0bc6a739b82f9a26edaee9348b8f

  • SHA256

    49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283

  • SHA512

    5b20ce36b15f5d002d183850032067b11f811544bac19e0a76340df47294d0b059fa8dc43fedd8480d6f72eb8357d01924dbe9cbebdaac1625c5f4f498392822

  • SSDEEP

    196608:1a4vbUQYRyS/Kh44vTM1NExeka13ZlfNf5PWwShXBFPHIG1MZBwYFCnvkC2:7vDX0gZvT2U/S3ZllEhxFPIG1rYFC8C

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283.exe
    "C:\Users\Admin\AppData\Local\Temp\49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\onefile_1568_133782308763694000\stub.exe
      C:\Users\Admin\AppData\Local\Temp\49f4789274e5c0dcd4d2cc1b850761353bf8b72e819d12df5c376fd665da1283.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_1568_133782308763694000\python310.dll

    Filesize

    4.3MB

    MD5

    c80b5cb43e5fe7948c3562c1fff1254e

    SHA1

    f73cb1fb9445c96ecd56b984a1822e502e71ab9d

    SHA256

    058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

    SHA512

    faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

  • \Users\Admin\AppData\Local\Temp\onefile_1568_133782308763694000\stub.exe

    Filesize

    16.1MB

    MD5

    6fe46fd6e5b143f5114e6616c59b703c

    SHA1

    d7ec21b14605dedb9fa17fe94fdd4f38f27e46dd

    SHA256

    5de7d49690eddfc6c109081d498ecae18edb6d980a7380c05b0aade16a75d09a

    SHA512

    b339df96044a205713bff7e5b7341233017697966c69d26b8c8d9e6b216481d5401970e9ae9f2ee6285469c1de451033f8bc3a967b10657226665d4472b46250

  • memory/1568-75-0x000000013FA30000-0x0000000140502000-memory.dmp

    Filesize

    10.8MB

  • memory/2236-40-0x000000013F910000-0x0000000140979000-memory.dmp

    Filesize

    16.4MB