Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 18:00
Behavioral task
behavioral1
Sample
Tropical External.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Tropical External.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Stealer.pyc
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Stealer.pyc
Resource
win10v2004-20240508-en
General
-
Target
Tropical External.exe
-
Size
16.9MB
-
MD5
5b45e2f8cc5b5987b06cb02705210e0c
-
SHA1
55468c663ba6cca8fcd18e556e11625eb97b5c09
-
SHA256
80ee928d1c9395b8d4ab1fa21461dcbd561a1b15eb88f23be1d528460268be39
-
SHA512
a13b9a93d924eaa48fd790e43a41bee91ed0ea2aede41619509dc7f09650f89e73ba7b3ea1a1a00e88214f4558c29da59d94d6a01312f52bad30134f89f35e31
-
SSDEEP
393216:YT5S5AWDAcnJ7ZxlHOFS1+TtIiFt0VBxmS4hg/CxUZl:+aAWDTJ7B/1QtIXF4hY
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Tropical External.exepid process 2956 Tropical External.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Tropical External.exedescription pid process target process PID 2928 wrote to memory of 2956 2928 Tropical External.exe Tropical External.exe PID 2928 wrote to memory of 2956 2928 Tropical External.exe Tropical External.exe PID 2928 wrote to memory of 2956 2928 Tropical External.exe Tropical External.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tropical External.exe"C:\Users\Admin\AppData\Local\Temp\Tropical External.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tropical External.exe"C:\Users\Admin\AppData\Local\Temp\Tropical External.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI29282\python312.dllFilesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3