Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 12:55
Behavioral task
behavioral1
Sample
Blackwycghe.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Blackwycghe.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20240611-en
General
-
Target
Blackwycghe.exe
-
Size
13.0MB
-
MD5
9624aa9bf59c4964fc202fd428ce519d
-
SHA1
e1e56568f59a0e8bad7b18934af367b783063dbc
-
SHA256
915e18ee4e889e1612331e6e233e110380a1360e8f372d01e4681745b50a63ac
-
SHA512
ea2d940b11a3c7131afd45fc83a12c7cbab6f7ef879ba673702b5913172d4e2c3349ce65e4c2df85d71da9476bc998f75bc5a9f46c48c26ee5468cd98c956a2f
-
SSDEEP
393216:EAct+L01+l+uq+Vvj1+TtIiF90VQxOC7P6gM:EQ01+l+uqgvj1QtINHC7Pc
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Blackwycghe.exepid process 2792 Blackwycghe.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Blackwycghe.exepid process 2792 Blackwycghe.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1268 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1268 AUDIODG.EXE Token: 33 1268 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1268 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Blackwycghe.exedescription pid process target process PID 3008 wrote to memory of 2792 3008 Blackwycghe.exe Blackwycghe.exe PID 3008 wrote to memory of 2792 3008 Blackwycghe.exe Blackwycghe.exe PID 3008 wrote to memory of 2792 3008 Blackwycghe.exe Blackwycghe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Blackwycghe.exe"C:\Users\Admin\AppData\Local\Temp\Blackwycghe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Blackwycghe.exe"C:\Users\Admin\AppData\Local\Temp\Blackwycghe.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30082\python312.dllFilesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3