1877f5f99c834df6605e2fd22460fa93ce03b87d50e47ba7cb274d856257a159

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/02/2025, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DurableLauncher.exe
Size

10.5MB
MD5

3980d879e8cdab01a8c85a98863c2064
SHA1

65196c9bb57059f3b8f1f23e2a8f9204051a6473
SHA256

1877f5f99c834df6605e2fd22460fa93ce03b87d50e47ba7cb274d856257a159
SHA512

ebf991a2e495804c3414e6b70a0720253edd7a8c717a2d57ebcf099814b66b6717a03f4b207cb27701cd5d1415ccac3bd7c6bf0313c733713adae23dead4719f
SSDEEP

196608:H0jNSwsCQcSDUhj7237EAMJoOA394I1hKJgYkMAhfpww5vlb2wBsY:yowsCKohf2LEAZO5I1GgYkZ19b/iY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2768	last.exe

Loads dropped DLL 2 IoCs

pid	Process
2576	DurableLauncher.exe
2768	last.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2768	2576	DurableLauncher.exe	31
PID 2576 wrote to memory of 2768	2576	DurableLauncher.exe	31
PID 2576 wrote to memory of 2768	2576	DurableLauncher.exe	31

C:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\onefile_2576_133830653683242000\last.exe
  C:\Users\Admin\AppData\Local\Temp\DurableLauncher.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\onefile_2576_133830653683242000\last.exe

Filesize
15.8MB

MD5
6adfcfaed8015427390f85628f51a304

SHA1
a07005c48969d761d8f686a669fea1550b7b02e9

SHA256
12672f0f8b64f4016ee9a95d0bed2907356ff8657aac7a2a1e2fdaeade411a5d

SHA512
2314b4ec6881412bf9efcac73c800d5b826432883636a4554504a1326108c41510ef7fe140a4378be55cbb75efc133a434d3dc17545597fa52e3c489bf634a00

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2576_133830653683242000\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit