46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
141s
max time network
157s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/b641961018d09dfbd7fa9c15f09a7723.exe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

Processes:

b641961018d09dfbd7fa9c15f09a7723.exe

pid	process
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe
1748	b641961018d09dfbd7fa9c15f09a7723.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b641961018d09dfbd7fa9c15f09a7723.exe

pid process

1748 b641961018d09dfbd7fa9c15f09a7723.exe
1748 b641961018d09dfbd7fa9c15f09a7723.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b641961018d09dfbd7fa9c15f09a7723.exe

description	pid	process	target process
PID 1776 wrote to memory of 1748	1776	b641961018d09dfbd7fa9c15f09a7723.exe	b641961018d09dfbd7fa9c15f09a7723.exe
PID 1776 wrote to memory of 1748	1776	b641961018d09dfbd7fa9c15f09a7723.exe	b641961018d09dfbd7fa9c15f09a7723.exe
PID 1776 wrote to memory of 1748	1776	b641961018d09dfbd7fa9c15f09a7723.exe	b641961018d09dfbd7fa9c15f09a7723.exe

C:\Users\Admin\AppData\Local\Temp\foo\b641961018d09dfbd7fa9c15f09a7723.exe
"C:\Users\Admin\AppData\Local\Temp\foo\b641961018d09dfbd7fa9c15f09a7723.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\foo\b641961018d09dfbd7fa9c15f09a7723.exe
  "C:\Users\Admin\AppData\Local\Temp\foo\b641961018d09dfbd7fa9c15f09a7723.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI17762\Outlast 2.exe.manifest

MD5
dfba12f6a1bcef7cab2a570edde551a1

SHA1
a64a59ae58553241b73414ccb29e3dfd7ff637a3

SHA256
2c081caa531a78eeae3f3271ebc3030aa927df56f6571c73ed885390d234f805

SHA512
09545fbb8ba5064825807a4d7008fad87e1b31141b9a475c59e12766507ac6ebb08074bb515e2e4032c4d92677cc791fc9e4b86db8c6ff08e7e16efcc1340574

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17762\python27.dll

MD5
923a653560e28bac95bb500189da9b85

SHA1
619430c476c88179afd80fa2b9c94da7c7fce46d

SHA256
22dc0137af885167070cc5f1583fd72f262d4b7a3b432bd6dfd938d800d69f0b

SHA512
ee80533755d303b82e76269f60226c71919c6eac5127dc0a2c4838d476c32e742b8b1198428ab4f8b52537973d47ffbc8152c28b345df7ac7f4173174e948a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\bad.png

MD5
2ba096963e1c527a42a6e8d3597c05d6

SHA1
7248808fe866ad0db48e21f6b0a3a673738f7edd

SHA256
8e3434053274efe365df95bc33a3415e44076a95ab4065b994fbf08c8fd09544

SHA512
21bdd4858716416b85004c68f9c59a1c115155f35f72cbb5372b08847e9eb82c80e0ca1ac2f1d8210492df35e3758e7ee46fb10c8e214615d5897984cffc74d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\eula.txt

MD5
508d59b95631c297cfed06e2571a7dce

SHA1
db361302a99549757791bc9890512a8a117b5e0c

SHA256
51dfe967d8146ef9c9835d86ea11ff2a211f8d1b4523ca970b75d6a593a38543

SHA512
5285eb6dbf5e1b0c97d811556ea7792c39e7dd94cd366327e73c3ec4cb8cb613a36766a1d2eac786ce8535da99a8e692e5719fdb7a71256ad39170cd3e990a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\folder.png

MD5
14d0fc80cab977c9dbd106c71d3df562

SHA1
5f3a4aa9c65d20eeb635bab56dd65007a34df319

SHA256
672bf4a66aa4782f620d1039d785d19fd019cd5f3346d802c1e05f7a9e585ef1

SHA512
1b54680c462cca5275b9d8d2d691c31f8772a9cd89f88ab4cb93aa7f40a2f6e0ec397b49dd9a93ca92f0fbe2cffe1fec45a25de3b68ed3085e619fb6376e390b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\installer.ico

MD5
05b6d3e24446f730b3988afacee69d87

SHA1
9b4269b6350b6855f985c6042d98b8e8d9fd8d4f

SHA256
2a444d2cb01fdf213c55bb0dfbb089f4aa88168b493d85430bf0853a1cf60dfc

SHA512
7d912686d4749a01559d639babf6cef41480f46b6167f7769ebf043271b1c703155faf038ec47f88fddc34d5abaac20123db65d266f31aa1976efc8b00a753f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\instd.jpeg

MD5
e3b9de212012e2abc1fe8aa7320fca42

SHA1
65c58e1411a1909049c7f10a3b4895b04f9408d0

SHA256
59f88f7d2a2ebe37f70600631f72820d5d6a098113e03e9dc2c43c65d397c0e0

SHA512
77c2f4bb8572992d14125e6813e4fcd8576a5a3bcb7438889e07096163965331267dfc81f9b3a8d693ea1d9c60452e9923efa0f933a048611746187840181a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\ok.png

MD5
0e4a4d7a5a359cf6bbfd832ba0cbb027

SHA1
94c7e65c60e5cf833c233f0cadbf2372443dd2b9

SHA256
041a2fed8af4bb47dd38b03de9ab8dbe6bfdd6f438d9cd2f401b54adef9a929a

SHA512
1a97d4f381e7512b0e69305ad9b77885f67b8e14126b825f347f664530434aeed9b22bef61ee195c2789b81c2894372d4289b63276e0cbb4f9f6cfefa8159263

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\out2.jpg

MD5
652e1a98a24c44dfcbee0e32cdf0ff2d

SHA1
a7101b55f4da3a8eff847a2f1355a43f5af8033b

SHA256
1d749222704bf09ab6d8e99b2cdd63e43091a13cef56b9182f1eb3ae6b306c8f

SHA512
2124394a43155f12fb56f1e2103d5dec9bf0e38142ac8528c627a67f484f097f6da0d7bb034bc957c55ab137463ecd673319c02148bd7f35a74104da7d3cb20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._controls_.pyd

MD5
476c27482579b35edd944b23d9b4cbe0

SHA1
17c409c230d83bb690c1537b8e5c3a77c9d92fd3

SHA256
eee77d0113e59889155e3687d7f2470ec3827cabc42ed1931df0c60216e75033

SHA512
b61dd23625e75a4cf12b5d232b35a753d6ed5e0a11bd1e5118b6bfe7eaeb2bcb6d4bf7d631e1621b09877e9bb2c5e7773ff2a66863a62cde889a6f0c612a8c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._core_.pyd

MD5
6e369746dac5a3c8fbfa8e42384d24cb

SHA1
3639e97dda16d8dee5bc4e8fb129c7561c25743d

SHA256
6172e27e9d6ef53f3746ff744aa17175df5d6d15449b0a3b8b909e1088e485db

SHA512
bb8e1ba79e6170a8404e8b93c35abdf6a758acba441c2a0726eb5376919aaba07ea97398e4a078adc169b322df44a445029f01a06afb40047836df26ced17d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._gdi_.pyd

MD5
c24da5b8cf4b514da3103a488a64468f

SHA1
42e0b3817025feeb5cf295c7dcbb87512e093876

SHA256
635044bbed0c42ad822eff67ea640e964fbebc3096ad9512558cb1065dbf7487

SHA512
5a3c52f00ccba6f54bc16390c4753a7592db72ce6456d217884fa12036055c84f3dcb3b7367e7755cc0fc4eeac54845d2f6c9c26d67b858afa9bbb12f88a404b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._misc_.pyd

MD5
09447da870304e6f59ad73249b0c4d66

SHA1
c0bed8a738061a167e466dce227577ed4d6f02d6

SHA256
a6111b863804e0ee46b4ba4db0e71bdb62c7b60045030dd2fd39d2c09e7e787c

SHA512
d9933aa20effbdc9c175f95fe62d7f41d9c4dbfe3a6c1759dfb60469a33de5e97fbcf5df195071960efdec8155c2f883622683e76151bf9a1dea8c8ff279a37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._windows_.pyd

MD5
aef31f5c432da76567699a58dbcdbcf3

SHA1
c1507bc87cf8cb11ffa832de9c06de1c1dae4c12

SHA256
72083abc43d22a6430ef95e02793700ec29d0332d5b25d9ad799e6eb1f503351

SHA512
0798c0cbda94dbe37cb664ef21b95a47f27ea450d38a33844db344894d7436adf89474b0366eb8ecd08defed342abc5a00d32b13ac87f957e7d76030dc49f606

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wxbase30u_net_vc90_x64.dll

MD5
7eefcf1334495b2739dbd6a7732af0e6

SHA1
5f0f4978c82e14914ba3256a2a9e3ae22e6d335c

SHA256
4defcdd7298f6c9e08adb1bc4de2322d415a05621d4f804dbe10b6976882a63c

SHA512
6a4c8e49d8fb1ff3b0867611ca906cc12cea77f00a9002b2879550f6a70d14c369cf01f2c1ac8a6b708c3532df13f1d70427e5a347921938e46b9528e3f76318

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wxbase30u_vc90_x64.dll

MD5
91e44f03e81806af7eab3ce7bf49f4eb

SHA1
de698e750e55357b84095c54833c670f0b102f08

SHA256
d6b7533cc18a10b4b30783d9b310ab8e64fc0d622f2a46a40f2025944e6d8e1b

SHA512
ab45920fb94ecf9b410d5ac3cbccdc4da207d0356e58971b41d37cfe9e6647a217cf9791fe0f9010ed46286125afe906bd0436a8266043fbbf329091cc5b3a38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_adv_vc90_x64.dll

MD5
a88ff7b30ae983a4dc9442e3eb217637

SHA1
db4c28fb73f419965c8385f91d6e7f5a954c52c2

SHA256
f77ff55a21341f529368e0e62198f27c632892321869e00ad3557f3abac189fa

SHA512
664469c683bb4c71fbe0c82f1e53c11ce0897d29315eebb73451de97fc3dac2824b7ecdc0cd4b45c4056a27c8364a9c3cf37fe27a5480c2d9e6ba55f793aecce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_core_vc90_x64.dll

MD5
3c0d40c45e28c52b9279d2428dd2f2c9

SHA1
2b6e3076521757cb506d0483b5aa19ef36b3e253

SHA256
24a0508931dc78e728202bd18e217d6a29d52e7b892b17cf295e0fac3cc28b31

SHA512
31e4e718d302aa338f5f4a431d8dde8b070a79faa3d2d250d31103dd72627e226b2f22f85d192a5cf3a783c5c7a5ad02711d43279a2a3eba854c14a3960917c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_html_vc90_x64.dll

MD5
f19cab5fb29c4441c9e8bcd1b4a3d3de

SHA1
c99bbfddc19155c0feac9fd77f9819f88d23e90c

SHA256
a4c2c14fa1d570cf521d16d23f1a0493445e7f963b5b9bd29298d88a29f4037f

SHA512
953f100787651016af3326e754f7e14df67c718fb80ed202b9edf9f653e2f647ad5fed15a49627a82d1e4a0f018d64117fb1e4c557e6cd96a9406362455f07b9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17762\python27.dll

MD5
923a653560e28bac95bb500189da9b85

SHA1
619430c476c88179afd80fa2b9c94da7c7fce46d

SHA256
22dc0137af885167070cc5f1583fd72f262d4b7a3b432bd6dfd938d800d69f0b

SHA512
ee80533755d303b82e76269f60226c71919c6eac5127dc0a2c4838d476c32e742b8b1198428ab4f8b52537973d47ffbc8152c28b345df7ac7f4173174e948a0a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._controls_.pyd

MD5
476c27482579b35edd944b23d9b4cbe0

SHA1
17c409c230d83bb690c1537b8e5c3a77c9d92fd3

SHA256
eee77d0113e59889155e3687d7f2470ec3827cabc42ed1931df0c60216e75033

SHA512
b61dd23625e75a4cf12b5d232b35a753d6ed5e0a11bd1e5118b6bfe7eaeb2bcb6d4bf7d631e1621b09877e9bb2c5e7773ff2a66863a62cde889a6f0c612a8c83

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._core_.pyd

MD5
6e369746dac5a3c8fbfa8e42384d24cb

SHA1
3639e97dda16d8dee5bc4e8fb129c7561c25743d

SHA256
6172e27e9d6ef53f3746ff744aa17175df5d6d15449b0a3b8b909e1088e485db

SHA512
bb8e1ba79e6170a8404e8b93c35abdf6a758acba441c2a0726eb5376919aaba07ea97398e4a078adc169b322df44a445029f01a06afb40047836df26ced17d9c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._gdi_.pyd

MD5
c24da5b8cf4b514da3103a488a64468f

SHA1
42e0b3817025feeb5cf295c7dcbb87512e093876

SHA256
635044bbed0c42ad822eff67ea640e964fbebc3096ad9512558cb1065dbf7487

SHA512
5a3c52f00ccba6f54bc16390c4753a7592db72ce6456d217884fa12036055c84f3dcb3b7367e7755cc0fc4eeac54845d2f6c9c26d67b858afa9bbb12f88a404b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._misc_.pyd

MD5
09447da870304e6f59ad73249b0c4d66

SHA1
c0bed8a738061a167e466dce227577ed4d6f02d6

SHA256
a6111b863804e0ee46b4ba4db0e71bdb62c7b60045030dd2fd39d2c09e7e787c

SHA512
d9933aa20effbdc9c175f95fe62d7f41d9c4dbfe3a6c1759dfb60469a33de5e97fbcf5df195071960efdec8155c2f883622683e76151bf9a1dea8c8ff279a37b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wx._windows_.pyd

MD5
aef31f5c432da76567699a58dbcdbcf3

SHA1
c1507bc87cf8cb11ffa832de9c06de1c1dae4c12

SHA256
72083abc43d22a6430ef95e02793700ec29d0332d5b25d9ad799e6eb1f503351

SHA512
0798c0cbda94dbe37cb664ef21b95a47f27ea450d38a33844db344894d7436adf89474b0366eb8ecd08defed342abc5a00d32b13ac87f957e7d76030dc49f606

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wxbase30u_net_vc90_x64.dll

MD5
7eefcf1334495b2739dbd6a7732af0e6

SHA1
5f0f4978c82e14914ba3256a2a9e3ae22e6d335c

SHA256
4defcdd7298f6c9e08adb1bc4de2322d415a05621d4f804dbe10b6976882a63c

SHA512
6a4c8e49d8fb1ff3b0867611ca906cc12cea77f00a9002b2879550f6a70d14c369cf01f2c1ac8a6b708c3532df13f1d70427e5a347921938e46b9528e3f76318

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wxbase30u_vc90_x64.dll

MD5
91e44f03e81806af7eab3ce7bf49f4eb

SHA1
de698e750e55357b84095c54833c670f0b102f08

SHA256
d6b7533cc18a10b4b30783d9b310ab8e64fc0d622f2a46a40f2025944e6d8e1b

SHA512
ab45920fb94ecf9b410d5ac3cbccdc4da207d0356e58971b41d37cfe9e6647a217cf9791fe0f9010ed46286125afe906bd0436a8266043fbbf329091cc5b3a38

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_adv_vc90_x64.dll

MD5
a88ff7b30ae983a4dc9442e3eb217637

SHA1
db4c28fb73f419965c8385f91d6e7f5a954c52c2

SHA256
f77ff55a21341f529368e0e62198f27c632892321869e00ad3557f3abac189fa

SHA512
664469c683bb4c71fbe0c82f1e53c11ce0897d29315eebb73451de97fc3dac2824b7ecdc0cd4b45c4056a27c8364a9c3cf37fe27a5480c2d9e6ba55f793aecce

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_core_vc90_x64.dll

MD5
3c0d40c45e28c52b9279d2428dd2f2c9

SHA1
2b6e3076521757cb506d0483b5aa19ef36b3e253

SHA256
24a0508931dc78e728202bd18e217d6a29d52e7b892b17cf295e0fac3cc28b31

SHA512
31e4e718d302aa338f5f4a431d8dde8b070a79faa3d2d250d31103dd72627e226b2f22f85d192a5cf3a783c5c7a5ad02711d43279a2a3eba854c14a3960917c9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17~1\wxmsw30u_html_vc90_x64.dll

MD5
f19cab5fb29c4441c9e8bcd1b4a3d3de

SHA1
c99bbfddc19155c0feac9fd77f9819f88d23e90c

SHA256
a4c2c14fa1d570cf521d16d23f1a0493445e7f963b5b9bd29298d88a29f4037f

SHA512
953f100787651016af3326e754f7e14df67c718fb80ed202b9edf9f653e2f647ad5fed15a49627a82d1e4a0f018d64117fb1e4c557e6cd96a9406362455f07b9

Download Submit
memory/1748-0-0x0000000000000000-mapping.dmp

Download