Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 01:35
Behavioral task
behavioral1
Sample
36d7386b6047b0631e6a389a854fc152.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
36d7386b6047b0631e6a389a854fc152.exe
Resource
win10v2004-20240226-en
General
-
Target
36d7386b6047b0631e6a389a854fc152.exe
-
Size
9.0MB
-
MD5
36d7386b6047b0631e6a389a854fc152
-
SHA1
59db0e81f1c8cc2bd96d91a11effeb14ee567c77
-
SHA256
e16428519c448141126697f954edf42e0f7b0a3fd2ef13b3536db93f1b0121e5
-
SHA512
0494783794354acac9fcfbeea71255417c46581fea96b69429887150a1e921bf92b019fd130be10ac5f7b925c0d3b3d8c4c07d1b7ecc82845907f7fc29c03417
-
SSDEEP
196608:2Cxc2wuLIoBA1HeT39Iigwh1ncKOVVtc978EtQ1NQOv4U:VctIq1+TtIiFv0VQx76tl
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
36d7386b6047b0631e6a389a854fc152.exepid process 2072 36d7386b6047b0631e6a389a854fc152.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
36d7386b6047b0631e6a389a854fc152.exedescription pid process target process PID 3048 wrote to memory of 2072 3048 36d7386b6047b0631e6a389a854fc152.exe 36d7386b6047b0631e6a389a854fc152.exe PID 3048 wrote to memory of 2072 3048 36d7386b6047b0631e6a389a854fc152.exe 36d7386b6047b0631e6a389a854fc152.exe PID 3048 wrote to memory of 2072 3048 36d7386b6047b0631e6a389a854fc152.exe 36d7386b6047b0631e6a389a854fc152.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36d7386b6047b0631e6a389a854fc152.exe"C:\Users\Admin\AppData\Local\Temp\36d7386b6047b0631e6a389a854fc152.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36d7386b6047b0631e6a389a854fc152.exe"C:\Users\Admin\AppData\Local\Temp\36d7386b6047b0631e6a389a854fc152.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30482\python312.dllFilesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3