214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06

Resubmissions

25/03/2025, 12:07

250325-panv1ayrt8 10

08/02/2025, 12:09

250208-pbptpavper 10

08/02/2025, 11:46

250208-nxtjbsspgt 10

06/02/2025, 02:27

250206-cxm6rszlfs 10

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

altas installer.exe
Size

87.5MB
MD5

e1c8bc131cc1502e31dec5146351c557
SHA1

95792a7ed9bec9bccf88b3ecdffe1a06fb72b8ef
SHA256

214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06
SHA512

b5807f60f1c5d6fde557c7c27b5424e57eefe7c8c1a962f3949f3a412603f94dfb26eb18e30bd5e1ebbf705a9ef6ccd7d51fe4a74d9d525d1382257b19f4eac0
SSDEEP

1572864:z2GKlEWCsm/OkiqOv8im2AUdfmE7qliwiYgj+h58sMwhue9DOVwJq:znKe3sm/OknOv8i3XfCwy51ueV6

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1780	altas installer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000020a25-1264.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1780	2208	altas installer.exe	30
PID 2208 wrote to memory of 1780	2208	altas installer.exe	30
PID 2208 wrote to memory of 1780	2208	altas installer.exe	30

C:\Users\Admin\AppData\Local\Temp\altas installer.exe
"C:\Users\Admin\AppData\Local\Temp\altas installer.exe" sh /c quarantine %altas installer.exe%
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\altas installer.exe
  "C:\Users\Admin\AppData\Local\Temp\altas installer.exe" sh /c quarantine %altas installer.exe%
  2⤵
  - Loads dropped DLL
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22082\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/1780-1266-0x000007FEF62A0000-0x000007FEF6892000-memory.dmp

Filesize
5.9MB

Download