38c480b80c9767a45d1100daf021e91f5f0fa120065c3acfa364660103eebed0 | Triage

Analysis

max time kernel
4s
max time network
7s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05/03/2025, 19:14

Sharing

Report Analysis Logs

General

Target

Ghosty BUILT IN PY.exe
Size

14.6MB
MD5

5e8922016c84369715aab33c9620fc22
SHA1

369d8c585779e58c5029a678e75360f3c2a0e384
SHA256

38c480b80c9767a45d1100daf021e91f5f0fa120065c3acfa364660103eebed0
SHA512

853ba291aa54c007973f9ba99e16ac23f5619ceff6dd6d42b68275391bf1df95213eace449adf7342ecf02cf9a58f74ec2027a12f681737ad110be100dea611f
SSDEEP

393216:89Yi2Vlj87dZ/gdQuslSq9VoWOv+9fSZk1vwUrjLP2:89Yi2Vl8ZGdQuSTorvSKSFwUnLP2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1232	Ghosty BUILT IN PY.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1232	2356	Ghosty BUILT IN PY.exe	31
PID 2356 wrote to memory of 1232	2356	Ghosty BUILT IN PY.exe	31
PID 2356 wrote to memory of 1232	2356	Ghosty BUILT IN PY.exe	31

C:\Users\Admin\AppData\Local\Temp\Ghosty BUILT IN PY.exe
"C:\Users\Admin\AppData\Local\Temp\Ghosty BUILT IN PY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Ghosty BUILT IN PY.exe
  "C:\Users\Admin\AppData\Local\Temp\Ghosty BUILT IN PY.exe"
  2⤵
  - Loads dropped DLL
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23562\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit