Overview
overview
10Static
static
10CriticalFiles/SN.dll
windows7-x64
1CriticalFiles/SN.dll
windows10-2004-x64
1CriticalFi...er.exe
windows7-x64
10CriticalFi...er.exe
windows10-2004-x64
10CriticalFi...SN.exe
windows7-x64
7CriticalFi...SN.exe
windows10-2004-x64
8InstHndl.dll
windows7-x64
1InstHndl.dll
windows10-2004-x64
1SuperNova.exe
windows7-x64
1SuperNova.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:10
Behavioral task
behavioral1
Sample
CriticalFiles/SN.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
CriticalFiles/SN.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
CriticalFiles/SNInstallerHandler.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
CriticalFiles/SNInstallerHandler.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
CriticalFiles/StageSN.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
CriticalFiles/StageSN.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
InstHndl.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
InstHndl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
SuperNova.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
SuperNova.exe
Resource
win10v2004-20240508-en
General
-
Target
CriticalFiles/StageSN.exe
-
Size
6.0MB
-
MD5
6827ad0bc2db5262ba83e58e489452c0
-
SHA1
c7b04529a9ac85dd2fd6ea46cbc71a9841c0b207
-
SHA256
d020e692f2f2d30280d169b8b4ec3285adbb1e9f27abb35db6c88bb1999e8a26
-
SHA512
43bbb7353f7d48cf0dd90337b9e3aa507e1212ac1eb7bdd04711bf941f1f991d310bba553533bf369e18571bf08f570f5f8cb8a1dc0d683bff0da7c3708d7438
-
SSDEEP
98304:07EtdFBCbamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RLOuAKVq0DwKyf:0yFIeeN/FJMIDJf0gsAGK4RauAKVFw5f
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
StageSN.exepid process 2516 StageSN.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI18482\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
StageSN.exedescription pid process target process PID 1848 wrote to memory of 2516 1848 StageSN.exe StageSN.exe PID 1848 wrote to memory of 2516 1848 StageSN.exe StageSN.exe PID 1848 wrote to memory of 2516 1848 StageSN.exe StageSN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"C:\Users\Admin\AppData\Local\Temp\CriticalFiles\StageSN.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI18482\python310.dllFilesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
-
memory/2516-23-0x000007FEF5F90000-0x000007FEF63FE000-memory.dmpFilesize
4.4MB