Overview

overview

7

Static

static

3

23fda8b2da...c0.exe

windows7_x64

7

23fda8b2da...c0.exe

windows10_x64

7

Analysis

  • max time kernel
    14s
  • max time network
    102s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    23-02-2021 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23fda8b2da7bbe3920802e2f12040ec0.exe

  • Size

    6.9MB

  • MD5

    23fda8b2da7bbe3920802e2f12040ec0

  • SHA1

    4c4897bf596db179ea4a14f088b8aa1c6d229b1e

  • SHA256

    c9ac9582c979029bb83b4b14b735c764ef94bdac3dd59ebe5963d2ca0ad5f897

  • SHA512

    62b73d0e3f2695b63f0a7109c3a62f3efb7391f5fb917fd55724e9909b4ff38a737db857f20877e7d505bb927677e024830908026fb361071edca90dae1ab942

Score
7/10
spyware

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23fda8b2da7bbe3920802e2f12040ec0.exe
    "C:\Users\Admin\AppData\Local\Temp\23fda8b2da7bbe3920802e2f12040ec0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\23fda8b2da7bbe3920802e2f12040ec0.exe
      "C:\Users\Admin\AppData\Local\Temp\23fda8b2da7bbe3920802e2f12040ec0.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\VCRUNTIME140.dll
    MD5

    7942be5474a095f673582997ae3054f1

    SHA1

    e982f6ebc74d31153ba9738741a7eec03a9fa5e8

    SHA256

    8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

    SHA512

    49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_bz2.pyd
    MD5

    499462206034b6ab7d18cc208a5b67e3

    SHA1

    1cd350a9f5d048d337475e66dcc0b9fab6aebf78

    SHA256

    6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

    SHA512

    17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_ctypes.pyd
    MD5

    b74f6285a790ffd7e9ec26e3ab4ca8df

    SHA1

    7e023c1e4f12e8e577e46da756657fd2db80b5e8

    SHA256

    c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

    SHA512

    3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_hashlib.pyd
    MD5

    60f420a9a606e2c95168d25d2c1ac12e

    SHA1

    1e77cf7de26ed75208d31751fe61da5eddbbaf12

    SHA256

    8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

    SHA512

    aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_lzma.pyd
    MD5

    bc118fb4e14de484452bb1be413c082a

    SHA1

    25d09b7fbc2452457bcf7025c3498947bc96c2d1

    SHA256

    ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

    SHA512

    68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_pytransform.dll
    MD5

    849ba8d2d10533b2ea397706efcbbe45

    SHA1

    98c80f46d3716e6178ae4e24e92fbc4719d4f46c

    SHA256

    4caf44701fa9997a9441e75d6aa74f9b1f9797a68faa3c0e9c968a583ebbd0a2

    SHA512

    749fa12a316d4f1b7c12102b546068d39b173de89252b1a45f0f8bf6b60940e654c04ebda9b0cc4f38fcd4649375540f5c89c1d8a4eb5426b9e56646282f59bb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_socket.pyd
    MD5

    0df2287791c20a764e6641029a882f09

    SHA1

    8a0aeb4b4d8410d837469339244997c745c9640c

    SHA256

    09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

    SHA512

    60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\_ssl.pyd
    MD5

    66172f2e3a46d2a0f04204d8f83c2b1e

    SHA1

    e74fee81b719effc003564edb6b50973f7df9364

    SHA256

    2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01

    SHA512

    123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\base_library.zip
    MD5

    804ee274b3994298b4a17b0c3814d013

    SHA1

    039198d625b09b0a033516fec805f0c2068a4b81

    SHA256

    acbd85a783b4252e09829370d23c9b9f661fb28d5cc3e6526de4273805676e25

    SHA512

    5ea798b79546c5734ffff4f17677e10108882cdd5fbc83fdf0a8687a336a8e09d9a7e676123c34a26d90cc258c30e7209ed2091c44ee8fcc6e90026bc6a1b6ff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\libcrypto-1_1.dll
    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\libffi-7.dll
    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\libssl-1_1.dll
    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\python39.dll
    MD5

    c4b75218b11808db4a04255574b2eb33

    SHA1

    f4a3497fb6972037fb271cfdc5b404a4b28ccf07

    SHA256

    53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

    SHA512

    0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\select.pyd
    MD5

    a2a4cf664570944ccc691acf47076eeb

    SHA1

    918a953817fff228dbd0bdf784ed6510314f4dd9

    SHA256

    b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

    SHA512

    d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI10562\unicodedata.pyd
    MD5

    5753efb74fcb02a31a662d9d47a04754

    SHA1

    e7bf5ea3a235b6b661bf6d838e0067db0db0c5f4

    SHA256

    9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72

    SHA512

    86372016c3b43bfb85e0d818ab02a471796cfad6d370f88f54957dfc18a874a20428a7a142fcd5a2ecd4a61f047321976af736185896372ac8fd8ca4131f3514

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\VCRUNTIME140.dll
    MD5

    7942be5474a095f673582997ae3054f1

    SHA1

    e982f6ebc74d31153ba9738741a7eec03a9fa5e8

    SHA256

    8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

    SHA512

    49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_bz2.pyd
    MD5

    499462206034b6ab7d18cc208a5b67e3

    SHA1

    1cd350a9f5d048d337475e66dcc0b9fab6aebf78

    SHA256

    6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

    SHA512

    17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_ctypes.pyd
    MD5

    b74f6285a790ffd7e9ec26e3ab4ca8df

    SHA1

    7e023c1e4f12e8e577e46da756657fd2db80b5e8

    SHA256

    c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

    SHA512

    3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_hashlib.pyd
    MD5

    60f420a9a606e2c95168d25d2c1ac12e

    SHA1

    1e77cf7de26ed75208d31751fe61da5eddbbaf12

    SHA256

    8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

    SHA512

    aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_lzma.pyd
    MD5

    bc118fb4e14de484452bb1be413c082a

    SHA1

    25d09b7fbc2452457bcf7025c3498947bc96c2d1

    SHA256

    ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

    SHA512

    68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_pytransform.dll
    MD5

    849ba8d2d10533b2ea397706efcbbe45

    SHA1

    98c80f46d3716e6178ae4e24e92fbc4719d4f46c

    SHA256

    4caf44701fa9997a9441e75d6aa74f9b1f9797a68faa3c0e9c968a583ebbd0a2

    SHA512

    749fa12a316d4f1b7c12102b546068d39b173de89252b1a45f0f8bf6b60940e654c04ebda9b0cc4f38fcd4649375540f5c89c1d8a4eb5426b9e56646282f59bb

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_socket.pyd
    MD5

    0df2287791c20a764e6641029a882f09

    SHA1

    8a0aeb4b4d8410d837469339244997c745c9640c

    SHA256

    09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

    SHA512

    60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\_ssl.pyd
    MD5

    66172f2e3a46d2a0f04204d8f83c2b1e

    SHA1

    e74fee81b719effc003564edb6b50973f7df9364

    SHA256

    2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01

    SHA512

    123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\libcrypto-1_1.dll
    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\libffi-7.dll
    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\libssl-1_1.dll
    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\python39.dll
    MD5

    c4b75218b11808db4a04255574b2eb33

    SHA1

    f4a3497fb6972037fb271cfdc5b404a4b28ccf07

    SHA256

    53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2

    SHA512

    0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\select.pyd
    MD5

    a2a4cf664570944ccc691acf47076eeb

    SHA1

    918a953817fff228dbd0bdf784ed6510314f4dd9

    SHA256

    b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

    SHA512

    d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI10562\unicodedata.pyd
    MD5

    5753efb74fcb02a31a662d9d47a04754

    SHA1

    e7bf5ea3a235b6b661bf6d838e0067db0db0c5f4

    SHA256

    9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72

    SHA512

    86372016c3b43bfb85e0d818ab02a471796cfad6d370f88f54957dfc18a874a20428a7a142fcd5a2ecd4a61f047321976af736185896372ac8fd8ca4131f3514

    Download Submit

  • memory/2856-2-0x0000000000000000-mapping.dmp

    Download