Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 11:10
Behavioral task
behavioral1
Sample
ketamine.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ketamine.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
ketamine.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
ketamine.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ketamine.exe
Resource
win11-20240611-en
General
-
Target
ketamine.exe
-
Size
25.8MB
-
MD5
7b513480b32c6038e61413461664063c
-
SHA1
e12e1f035da33f435ac5723e59502f2a0a4345de
-
SHA256
b69a4fef963a0d91d405a3f2094581ef22bfe0e6aa0c67a10eb560a683f6e606
-
SHA512
b16c36a2bf5587c8b72ec2ff56e20f3b09d1880d6592ce83f9f7442ce1705f7b553c314f2890a7fc1a47c0d0675d7836602d0600ef2627ade83432d9852d3655
-
SSDEEP
393216:to9DM45UUDtSJurEUWjagZewBm6bjHTw6:S9N6cYdb9ZewBmUHJ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ketamine.exepid process 2452 ketamine.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI28682\python312.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ketamine.exedescription pid process target process PID 2868 wrote to memory of 2452 2868 ketamine.exe ketamine.exe PID 2868 wrote to memory of 2452 2868 ketamine.exe ketamine.exe PID 2868 wrote to memory of 2452 2868 ketamine.exe ketamine.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI28682\python312.dllFilesize
1.7MB
MD518677d48ba556e529b73d6e60afaf812
SHA168f93ed1e3425432ac639a8f0911c144f1d4c986
SHA2568e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8
SHA512a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02
-
memory/2452-97-0x000007FEF6040000-0x000007FEF6704000-memory.dmpFilesize
6.8MB