470ffa493e7716c84c02bcf84c1cde3116160f3904d1166c7da3defa4fad5f94

Analysis

max time kernel
13s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
23-02-2021 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6dcf77566f95cf1c3da2da320fb1e7.exe
Size

6.1MB
MD5

0e6dcf77566f95cf1c3da2da320fb1e7
SHA1

3674a5116c4b0af27b15a4f79a9a1f1cd45585e3
SHA256

470ffa493e7716c84c02bcf84c1cde3116160f3904d1166c7da3defa4fad5f94
SHA512

f668432eec07617e4a44b8852843c6c51dd993981190c740bdfc47f70775b5420c7bdfa73c51a7a3f58b7d5f7c96ec3f4bb0b721ae563ee1ed4a99a636e9764d

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 14 IoCs

Processes:

0e6dcf77566f95cf1c3da2da320fb1e7.exe

pid	process
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe
3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e6dcf77566f95cf1c3da2da320fb1e7.exe

description pid process

Token: 35 3412 0e6dcf77566f95cf1c3da2da320fb1e7.exe

description	pid	process
Token: 35	3412	0e6dcf77566f95cf1c3da2da320fb1e7.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0e6dcf77566f95cf1c3da2da320fb1e7.exe

description	pid	process	target process
PID 1192 wrote to memory of 3412	1192	0e6dcf77566f95cf1c3da2da320fb1e7.exe	0e6dcf77566f95cf1c3da2da320fb1e7.exe
PID 1192 wrote to memory of 3412	1192	0e6dcf77566f95cf1c3da2da320fb1e7.exe	0e6dcf77566f95cf1c3da2da320fb1e7.exe

C:\Users\Admin\AppData\Local\Temp\0e6dcf77566f95cf1c3da2da320fb1e7.exe
"C:\Users\Admin\AppData\Local\Temp\0e6dcf77566f95cf1c3da2da320fb1e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\0e6dcf77566f95cf1c3da2da320fb1e7.exe
"C:\Users\Admin\AppData\Local\Temp\0e6dcf77566f95cf1c3da2da320fb1e7.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI11922\VCRUNTIME140.dll

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_bz2.pyd

MD5
4079b0e80ef0f97ce35f272410bd29fe

SHA1
19ef1b81a1a0b3286bac74b6af9a18ed381bf92c

SHA256
466d21407f5b589b20c464c51bfe2be420e5a586a7f394908448545f16b08b33

SHA512
21cd5a848f69b0d1715e62dca89d1501f7f09edfe0fa2947cfc473ca72ed3355bfccd32c3a0cdd5f65311e621c89ddb67845945142a4b1bdc5c70e7f7b99ed67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_ctypes.pyd

MD5
2f21f50d2252e3083555a724ca57b71e

SHA1
49ec351d569a466284b8cc55ee9aeaf3fbf20099

SHA256
09887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce

SHA512
e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_hashlib.pyd

MD5
c3b19ad5381b9832e313a448de7c5210

SHA1
51777d53e1ea5592efede1ed349418345b55f367

SHA256
bdf4a536f783958357d2e0055debdc3cf7790ee28beb286452eec0354a346bdc

SHA512
7f8d3b79a58612e850d18e8952d14793e974483c688b5daee217baaa83120fd50d1e036ca4a1b59d748b22951744377257d2a8f094a4b4de1f79fecd4bf06afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_lzma.pyd

MD5
a567a2ecb4737e5b70500eac25f23049

SHA1
951673dd1a8b5a7f774d34f61b765da2b4026cab

SHA256
a4cba6d82369c57cb38a32d4dacb99225f58206d2dd9883f6fc0355d6ddaec3d

SHA512
97f3b1c20c9a7ed52d9781d1e47f4606579faeae4d98ba09963b99cd2f13426dc0fc2aeb4bb3af18ed584c8ba9d5b6358d8e34687a1d5f74a3954b3f84d12349

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_queue.pyd

MD5
2325dab36242fc732c85914ab7ce25af

SHA1
b4a81b312b6e037a0aa4a2e2de5e331cb2803648

SHA256
2ffa512a2a369ccd3713419c6d4e36c2bd5d1967e046663d721d7e7ac9e4ab59

SHA512
13f92c90a81f5dfbc15cadfd31dbc30b5c72c93dc7ad057f4b211388c3a57ab070bd25c0f1212173a0772972b2d3aa2caedbfb7e3513ffc0d83a15dbc9198b87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_socket.pyd

MD5
d7e7a7592338ce88e131f858a84deec6

SHA1
3add8cd9fbbf7f5fa40d8a972d9ac18282dcf357

SHA256
4ba5d0e236711bdcb29ce9c3138406f7321bd00587b6b362b4ace94379cf52d5

SHA512
96649296e8ccdc06d6787902185e21020a700436fc7007b2aa6464d0af7f9eb66a4485b3d46461106ac5f1d35403183daa1925e842e7df6f2db9e3e833b18fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\_ssl.pyd

MD5
d429ff3fd91943ad8539c076c2a0c75f

SHA1
bb6611ddca8ebe9e4790f20366b89253a27aed02

SHA256
45c8b99ba9e832cab85e9d45b5601b7a1d744652e7f756ec6a6091e1d8398dd4

SHA512
019178eecb9fb3d531e39854685a53fa3df5a84b1424e4a195f0a51ca0587d1524fd8fbd6d4360188ea9c2f54d7019c7d335ec6dc5471128159153c2287b0e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\base_library.zip

MD5
ced006a2c9e993a1f2171d430298178e

SHA1
21e3e95180f828c757d81b8354209d15ec40c958

SHA256
fc31e81942909e136be9bf566cc3d6279f4463f27a4c41cce11d6b7e2ac6b4ca

SHA512
8cd91974c53cf4c16c9cddaeb7030c18820d54ee0931760593b853449d8132809c7a4e4135d89ea1672110dc471f085bbefb9a5c60c0f9fdfe4d434984ee6f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\certifi\cacert.pem

MD5
712a0c9e3337edc7f4c6c36a67727866

SHA1
cd0cc7f28f7c8aefea6f54f392c7bd68acacf572

SHA256
53b8854f8fe7fbb5c27c7a5cf08e3a69de641ee1af0d279d95ad9f75b428414a

SHA512
2183f4eaf351e500054039eecabf76df00c1fd66d777ac7cffab841bcbf6a60673d138c550b6e73bc80c5c7a162f399e4a6a62b120841df2902313cb747b14c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\libcrypto-1_1-x64.dll

MD5
022a61849adab67e3a59bcf4d0f1c40b

SHA1
fca2e1e8c30767c88f7ab5b42fe2bd9abb644672

SHA256
2a57183839c3e9cc4618fb1994c40e47672a8b6daffaa76c5f89cf2542b02c2f

SHA512
94ac596181f0887af7bf02a7ce31327ad443bb7fe2d668217953e0f0c782d19296a80de965008118708afd9bda14fd8c78f49785ebf7abcc37d166b692e88246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\libssl-1_1-x64.dll

MD5
4ec3c7fe06b18086f83a18ffbb3b9b55

SHA1
31d66ffab754fe002914bff2cf58c7381f8588d9

SHA256
9d35d8dd9854a4d4205ae4eafe28c92f8d0e3ac7c494ac4a6a117f6e4b45170c

SHA512
d53ee1f7c082a27ace38bf414529d25223c46bfae1be0a1fbe0c5eab10a7b10d23571fd9812c3be591c34059a4c0028699b4bf50736582b06a17ae1ef1b5341e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\nitrogenerator.exe.manifest

MD5
55b4c3d92eb6d5cf694425625e744a23

SHA1
def09713af2a3e72640e87325a8e32e4cc62eec1

SHA256
8fff217805c8102c7ba3b58754de87808e4aa0474bdb7492690518646a205680

SHA512
280b58705ca3b02b85417d272fd3dd1fe0be5a1640b70a4620103a7a2f160c21f13551a124511dcc2e119f0806ae6b7e586e19c7a96df2a49b173ac391dc3901

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\python37.dll

MD5
62125a78b9be5ac58c3b55413f085028

SHA1
46c643f70dd3b3e82ab4a5d1bc979946039e35b2

SHA256
17c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f

SHA512
e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\select.pyd

MD5
c30e5eccf9c62b0b0bc57ed591e16cc0

SHA1
24aece32d4f215516ee092ab72471d1e15c3ba24

SHA256
56d1a971762a1a56a73bdf64727e416ffa9395b8af4efcd218f5203d744e1268

SHA512
3e5c58428d4c166a3d6d3e153b46c4a57cca2e402001932ec90052c4689b7f5ba4c5f122d1a66d282b2a0a0c9916dc5a5b5e5f6dfc952cdb62332ac29cb7b36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\ucrtbase.dll

MD5
2381e189321ead521ff71e72d08a6b17

SHA1
0db7fea07b4bc14f0f9d71ecfa6ddf3097229875

SHA256
4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806

SHA512
2d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11922\unicodedata.pyd

MD5
7d1f105cf81820bb6d0962b669897dde

SHA1
6c4897147c05c6d6da98dd969bf84e12cc5682be

SHA256
71b13fd922190081d3aeec8628bd72858cc69ee553e16bf3da412f535108d0e4

SHA512
7546c3afb0440dc0e4c0f24d7b145a4f162cda72068cc51f7dc1a644454b645c0b3c954920c489b0748ba4c1ea2c34e86ba2565770e08077c2fdd02fd237f9d3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\VCRUNTIME140.dll

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_bz2.pyd

MD5
4079b0e80ef0f97ce35f272410bd29fe

SHA1
19ef1b81a1a0b3286bac74b6af9a18ed381bf92c

SHA256
466d21407f5b589b20c464c51bfe2be420e5a586a7f394908448545f16b08b33

SHA512
21cd5a848f69b0d1715e62dca89d1501f7f09edfe0fa2947cfc473ca72ed3355bfccd32c3a0cdd5f65311e621c89ddb67845945142a4b1bdc5c70e7f7b99ed67

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_ctypes.pyd

MD5
2f21f50d2252e3083555a724ca57b71e

SHA1
49ec351d569a466284b8cc55ee9aeaf3fbf20099

SHA256
09887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce

SHA512
e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_hashlib.pyd

MD5
c3b19ad5381b9832e313a448de7c5210

SHA1
51777d53e1ea5592efede1ed349418345b55f367

SHA256
bdf4a536f783958357d2e0055debdc3cf7790ee28beb286452eec0354a346bdc

SHA512
7f8d3b79a58612e850d18e8952d14793e974483c688b5daee217baaa83120fd50d1e036ca4a1b59d748b22951744377257d2a8f094a4b4de1f79fecd4bf06afb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_lzma.pyd

MD5
a567a2ecb4737e5b70500eac25f23049

SHA1
951673dd1a8b5a7f774d34f61b765da2b4026cab

SHA256
a4cba6d82369c57cb38a32d4dacb99225f58206d2dd9883f6fc0355d6ddaec3d

SHA512
97f3b1c20c9a7ed52d9781d1e47f4606579faeae4d98ba09963b99cd2f13426dc0fc2aeb4bb3af18ed584c8ba9d5b6358d8e34687a1d5f74a3954b3f84d12349

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_queue.pyd

MD5
2325dab36242fc732c85914ab7ce25af

SHA1
b4a81b312b6e037a0aa4a2e2de5e331cb2803648

SHA256
2ffa512a2a369ccd3713419c6d4e36c2bd5d1967e046663d721d7e7ac9e4ab59

SHA512
13f92c90a81f5dfbc15cadfd31dbc30b5c72c93dc7ad057f4b211388c3a57ab070bd25c0f1212173a0772972b2d3aa2caedbfb7e3513ffc0d83a15dbc9198b87

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_socket.pyd

MD5
d7e7a7592338ce88e131f858a84deec6

SHA1
3add8cd9fbbf7f5fa40d8a972d9ac18282dcf357

SHA256
4ba5d0e236711bdcb29ce9c3138406f7321bd00587b6b362b4ace94379cf52d5

SHA512
96649296e8ccdc06d6787902185e21020a700436fc7007b2aa6464d0af7f9eb66a4485b3d46461106ac5f1d35403183daa1925e842e7df6f2db9e3e833b18fb4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\_ssl.pyd

MD5
d429ff3fd91943ad8539c076c2a0c75f

SHA1
bb6611ddca8ebe9e4790f20366b89253a27aed02

SHA256
45c8b99ba9e832cab85e9d45b5601b7a1d744652e7f756ec6a6091e1d8398dd4

SHA512
019178eecb9fb3d531e39854685a53fa3df5a84b1424e4a195f0a51ca0587d1524fd8fbd6d4360188ea9c2f54d7019c7d335ec6dc5471128159153c2287b0e18

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\libcrypto-1_1-x64.dll

MD5
022a61849adab67e3a59bcf4d0f1c40b

SHA1
fca2e1e8c30767c88f7ab5b42fe2bd9abb644672

SHA256
2a57183839c3e9cc4618fb1994c40e47672a8b6daffaa76c5f89cf2542b02c2f

SHA512
94ac596181f0887af7bf02a7ce31327ad443bb7fe2d668217953e0f0c782d19296a80de965008118708afd9bda14fd8c78f49785ebf7abcc37d166b692e88246

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\libssl-1_1-x64.dll

MD5
4ec3c7fe06b18086f83a18ffbb3b9b55

SHA1
31d66ffab754fe002914bff2cf58c7381f8588d9

SHA256
9d35d8dd9854a4d4205ae4eafe28c92f8d0e3ac7c494ac4a6a117f6e4b45170c

SHA512
d53ee1f7c082a27ace38bf414529d25223c46bfae1be0a1fbe0c5eab10a7b10d23571fd9812c3be591c34059a4c0028699b4bf50736582b06a17ae1ef1b5341e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\python37.dll

MD5
62125a78b9be5ac58c3b55413f085028

SHA1
46c643f70dd3b3e82ab4a5d1bc979946039e35b2

SHA256
17c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f

SHA512
e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\select.pyd

MD5
c30e5eccf9c62b0b0bc57ed591e16cc0

SHA1
24aece32d4f215516ee092ab72471d1e15c3ba24

SHA256
56d1a971762a1a56a73bdf64727e416ffa9395b8af4efcd218f5203d744e1268

SHA512
3e5c58428d4c166a3d6d3e153b46c4a57cca2e402001932ec90052c4689b7f5ba4c5f122d1a66d282b2a0a0c9916dc5a5b5e5f6dfc952cdb62332ac29cb7b36a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\ucrtbase.dll

MD5
2381e189321ead521ff71e72d08a6b17

SHA1
0db7fea07b4bc14f0f9d71ecfa6ddf3097229875

SHA256
4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806

SHA512
2d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI11922\unicodedata.pyd

MD5
7d1f105cf81820bb6d0962b669897dde

SHA1
6c4897147c05c6d6da98dd969bf84e12cc5682be

SHA256
71b13fd922190081d3aeec8628bd72858cc69ee553e16bf3da412f535108d0e4

SHA512
7546c3afb0440dc0e4c0f24d7b145a4f162cda72068cc51f7dc1a644454b645c0b3c954920c489b0748ba4c1ea2c34e86ba2565770e08077c2fdd02fd237f9d3

Download Submit
memory/3412-2-0x0000000000000000-mapping.dmp

Download