Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 22:57
Behavioral task
behavioral1
Sample
galaxy_swapper_v2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
galaxy_swapper_v2.exe
Resource
win10v2004-20240226-en
General
-
Target
galaxy_swapper_v2.exe
-
Size
18.6MB
-
MD5
a923c5f39fb20d0b2622f9b7e7974760
-
SHA1
0f3dca40d8ed149b2c908be4db8f98651e7b6148
-
SHA256
c68ad8cda0b771c8e4f7cf0220c1b4fbde0aa05484a05b97446dbed3816f1a51
-
SHA512
e9b0b63ff9bb201e6800a358f026d23279c8d5644a3bc80d00b60daf3776b66d5ec6fabfbdd5fc3d1c3a1a0c7024f575bae411f29b7d96ee969bc187e3b9c0c3
-
SSDEEP
393216:BqPnLFXlrRtQpDOETgsEAfGFwrgmdHGvEH5wKmq:oPLFXNRtQoEEKhBSc
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
galaxy_swapper_v2.exepid process 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe 1260 galaxy_swapper_v2.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI24322\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
galaxy_swapper_v2.exedescription pid process target process PID 2432 wrote to memory of 1260 2432 galaxy_swapper_v2.exe galaxy_swapper_v2.exe PID 2432 wrote to memory of 1260 2432 galaxy_swapper_v2.exe galaxy_swapper_v2.exe PID 2432 wrote to memory of 1260 2432 galaxy_swapper_v2.exe galaxy_swapper_v2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\galaxy_swapper_v2.exe"C:\Users\Admin\AppData\Local\Temp\galaxy_swapper_v2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\galaxy_swapper_v2.exe"C:\Users\Admin\AppData\Local\Temp\galaxy_swapper_v2.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\api-ms-win-core-file-l1-2-0.dllFilesize
22KB
MD52083c4c18b0b2d501995bf1af79bbcf1
SHA19cbd7dd86fba3f1829d2f9614caa83958f690e99
SHA25601b61d57ba1290bf2640ecee28de3d240eeb09e9c664c0f4d0f9402cd1da5eaf
SHA5125eb5455989e1dbc8655c510d2b596d422078ecef8342d9d10797eba2d8aa1562b9037ede35f00222c3cfb6f46e003bd4bd1e17faa2d19e0aeb63e970c978da23
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\api-ms-win-core-file-l2-1-0.dllFilesize
22KB
MD5aaf93ef5c6eca9434286274ef91794dd
SHA1b68cd2f56e5c840346e3ad52255a6061c1797a7b
SHA2564413208101061038455b7e0752fb37d4108b3ec4642d10cbaddf835b3843888e
SHA51204a30769851b829e71ba0ab3f1a76eceae565dd639047b4c6ff9952bc4d6502d117eec81e151843dfaa147894e3046a333e39d2dae2ae65effd7dc1b91368541
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\api-ms-win-core-localization-l1-2-0.dllFilesize
22KB
MD59e1e3021560384db14b76243df9604e4
SHA1f79a3241314f18db0b979af8e114c191d499a7c9
SHA256197b29ba3989e8d974e29f81fbddd0731051399dc40763bda998a1e36d1c3ab4
SHA5123187122bd3e20dc74efac802b86c612573682370a8b24c3ec7769e67de525b68c91506b85df3ea2d028d4018d14833c980ab2b220aee41b96e2dd9c9d0a67914
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\api-ms-win-core-processthreads-l1-1-1.dllFilesize
22KB
MD5bf87834418025b5894d2130668352125
SHA1ef15f9b1ae6fb271549dd2cef8fb11ba5633c865
SHA256408081a4655ee846c1067aaafe462a62fa3a562341e681d0dbbf3400362f5cf7
SHA512b115687e542fc1a7f342cf610c450dc726d79e7b8e63bb2d5761a47464796fbf8c880ed811149443734f0d47c4cf8b2694a3703004d69cbd62fbf2a96d9667ec
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\api-ms-win-core-timezone-l1-1-0.dllFilesize
22KB
MD580bd4ecd52c736047b21f0c4c6bdaa95
SHA18ac491285818f19485351253129889839d97aedf
SHA25604f932559f3e5eec0d929d60ab501fc0f6037e97b241e2b3ddd3ad16fedaa23c
SHA5123f79a2c1635eec05c7a9e561842e2bed227d1d3db72b6cc34e121bfeb29755d51db707bee955a1d1e24e4faea8ef8426283b8c0820a528001851600ab20cf7e3
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\python310.dllFilesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
C:\Users\Admin\AppData\Local\Temp\_MEI24322\ucrtbase.dllFilesize
1.1MB
MD58f53604f28132832353c099fadb2a54c
SHA17679e25d80e7d551c390e6ac6f7561bf2368f734
SHA2565d652e1ba943587035b573e0dbcdc8a2f114030ac5cae4894805cc228dda3d22
SHA5125b7e3775a0eca8ade32e092287342f20c80ba3f96ce2008eff5a68e0ac952087f4a19ca5f6a7bf1e3a8add8aed49ec8168238461f777445104bae9d89b99a43a
-
memory/1260-166-0x000007FEF5F60000-0x000007FEF63CE000-memory.dmpFilesize
4.4MB