Resubmissions
09-01-2025 13:19
250109-qkxrbssqcl 1009-01-2025 13:10
250109-qerccszrdx 1009-01-2025 13:07
250109-qcw5tszrbs 1005-12-2024 07:58
241205-jttmpsvqgv 10Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09-01-2025 13:10
Behavioral task
behavioral1
Sample
Valid8Proxy/Data/Modules/Checker.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Valid8Proxy/Data/Modules/Checker.exe
Resource
win10v2004-20241007-en
General
-
Target
Valid8Proxy/Data/Modules/Checker.exe
-
Size
6.0MB
-
MD5
7b23b16fb9cb368b3b282f96d5067229
-
SHA1
0393a31b074ce29a904e97929da620d3a2bc9f89
-
SHA256
7e55049a20a923847008b11dd7c0886ab0b88bc9cf612fd4548191453c4fc5c9
-
SHA512
57bc40d31995d451c1600de88e5f3c20253e63f248251033d2f92ab9d415c6d648ef4f1025e810ef7f561e7a45be6746de7a78da9a91467329145b6a40f0d8cf
-
SSDEEP
98304:r75PmoDUN43WlmljOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a5tMu:H5PumWMOjmFwDRxtYSHdK34kdai7bN3A
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2944 Checker.exe -
resource yara_rule behavioral1/files/0x000500000001a400-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2944 2792 Checker.exe 30 PID 2792 wrote to memory of 2944 2792 Checker.exe 30 PID 2792 wrote to memory of 2944 2792 Checker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"2⤵
- Loads dropped DLL
PID:2944
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20