Analysis
-
max time kernel
6s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 13:00
Behavioral task
behavioral1
Sample
BoostrapperV1.24.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
BoostrapperV1.24.exe
Resource
win10v2004-20241007-en
General
-
Target
BoostrapperV1.24.exe
-
Size
7.6MB
-
MD5
16e20af759391f4deb62ea9e91d5b6e3
-
SHA1
0169305e4b33d23952a6a2d3ff75c7de7e113ede
-
SHA256
07d582c015b2b7e188e1949e121f24bcfa1f328efc61753b8bd59e7e7355b5cf
-
SHA512
f2783b9ad25ff055e8a1a40aa6f5cc90bc3d34560fd32f89156069774a79bac498d93044da019c0528ad297b4612ba81dfaecb69001bd87c480107140c0c9965
-
SSDEEP
196608:PtD+kd7wfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWc:F5OIHL7HmBYXrYSaUNC
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1420 BoostrapperV1.24.exe -
resource yara_rule behavioral1/files/0x0005000000018704-21.dat upx behavioral1/memory/1420-23-0x000007FEF5770000-0x000007FEF5DD5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1420 1584 BoostrapperV1.24.exe 30 PID 1584 wrote to memory of 1420 1584 BoostrapperV1.24.exe 30 PID 1584 wrote to memory of 1420 1584 BoostrapperV1.24.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\BoostrapperV1.24.exe"C:\Users\Admin\AppData\Local\Temp\BoostrapperV1.24.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\BoostrapperV1.24.exe"C:\Users\Admin\AppData\Local\Temp\BoostrapperV1.24.exe"2⤵
- Loads dropped DLL
PID:1420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69