Analysis
-
max time kernel
45s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
06-01-2025 05:43
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20241007-en
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral3
Sample
H~�B̷�.pyc
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
H~�B̷�.pyc
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
10.0MB
-
MD5
2c2442a79fa52676f059c00d8147996f
-
SHA1
fae8af8b7e96c8848abbb129f903837b88f22a9a
-
SHA256
b2f93bda5c451f7a5f30d019fb79c8071afa22ae169905d782eb8278234c5e12
-
SHA512
66c4e17ed26fbe8ea1ea41fd157a2811d6feda77f469b3219b0d04f42af66a34772efd46d63216d55250d9844575c352a792253c1e2d73f50d4c752870781b1e
-
SSDEEP
98304:ASDjWM8JEE1FJbswamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEb:AS07sReNTfm/pf+xk4dWRpmrbW3jmru
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2264 Loader.exe -
resource yara_rule behavioral1/files/0x00050000000187a8-21.dat upx behavioral1/memory/2264-23-0x000007FEF6260000-0x000007FEF6848000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe 1004 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2264 2928 Loader.exe 30 PID 2928 wrote to memory of 2264 2928 Loader.exe 30 PID 2928 wrote to memory of 2264 2928 Loader.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"2⤵
- Loads dropped DLL
PID:2264
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31