7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
Size

6.2MB
MD5

ac44449d30a56d2fdcc084b9f5a84d81
SHA1

dab9242cc3759f530622e12a05bd5f8e79b77efa
SHA256

7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071
SHA512

125105d8ac9f35a58e15db22851013da7a0bba7503e88af98199fadacdd67cf216aeb31aa6416e90b08cb64d6af26031921904fb8d302f297c91699339d951ac

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 14 IoCs

Processes:

7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

pid	process
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.ipify.org
2 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

description pid process

Token: 35 1156 7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

flow	ioc
1	api.ipify.org
2	api.ipify.org

description	pid	process
Token: 35	1156	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

description	pid	process	target process
PID 2036 wrote to memory of 1156	2036	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
PID 2036 wrote to memory of 1156	2036	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
PID 2036 wrote to memory of 1156	2036	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe	7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe

C:\Users\Admin\AppData\Local\Temp\7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
"C:\Users\Admin\AppData\Local\Temp\7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe
"C:\Users\Admin\AppData\Local\Temp\7cee12e92c446c1ac995c521cb98bbc937c893563fae00beeb3d8933cfd3e071.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_bz2.pyd
Filesize
87KB

MD5
429ad9f0d7240a1eb9c108b2d7c1382f

SHA1
f54e1c1d31f5dd6698e47750daf48b9291b9ea69

SHA256
d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

SHA512
bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_hashlib.pyd
Filesize
38KB

MD5
d61618c28373d7bbdf1dec7ec2b2b1c1

SHA1
51f4bab84620752aedf7d71dcccb577ed518e9fd

SHA256
33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

SHA512
ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_lzma.pyd
Filesize
251KB

MD5
5e7a6b749a05dd934ee4471411420053

SHA1
fcd1e54011b98928edbb3820a5838568b9573453

SHA256
4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

SHA512
ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_queue.pyd
Filesize
27KB

MD5
3f536949d0fcae286b08f6a90d4c5198

SHA1
04877dff7e8c994e4875a1b85b7388684b97da25

SHA256
613c0fc66b1f2f8dccb47f24f1578137a99c5a62550719f0402f13337ad5c60a

SHA512
cd59a4a2d839dec513b912e33bd92281a0fdfe0a210ae972cce8b77347e000bb87c8074d8b8cbfeba75158f2b8f3d0669f778fccec0dec936f055616cedbbb4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_socket.pyd
Filesize
74KB

MD5
7c5c5e6e4ed888dd26c7aa063bb9f88e

SHA1
a7a3694739b27c3d34beb1a9730fc3dcbae6744a

SHA256
2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

SHA512
9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_sqlite3.pyd
Filesize
84KB

MD5
553f11c6b37e39b09cfd700815df38c2

SHA1
b14916bb054e6503efee63d7b0cfc6e43f5cccfc

SHA256
34d101de287a6d1986c9c768ab7839b5cdda0dacd3848481c2aab83e4142b876

SHA512
445d0311a70cc1e9387219468359834e9274db978a227a910539316fab505783de246b26b0517baeb14b9656bedc5434f0be3ea881b9c2a8382a4dea4ecb64aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_ssl.pyd
Filesize
120KB

MD5
a3c9649e68206c25eff2d09a0bd323f0

SHA1
0f485f37ac3960da624b80667410061efe1f888d

SHA256
b9100db5d225c4103f781a6ea4074ce76387467c3a4bba2ac5bfc65870ab6123

SHA512
aeef27bf73cb7dd96b06c3403fc74c108a8a7d80aa25db35a4b1a96b8931aef63b3037a9a51075ead1e5ad1c001d6afe6f3c3e19af30344177fd562751b00d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\base_library.zip
Filesize
767KB

MD5
b029408c9cd1ed6348b65cf473d6ccfc

SHA1
a6c6f5f1c508ee93561e239a73d369f8b64b6fba

SHA256
c6c10c668d2e188c51c3ff8976fc7defbb247cfd2d547f6ca795094d6d271905

SHA512
d5a072699f5064c779ea750f55a618c45bba0fb7f12a1210eff46cc7d6855d874829d77a2a746d62aa56e297200b1359ff44ca731c0696d9b4775c58aa1cd5b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\certifi\cacert.pem
Filesize
275KB

MD5
c760591283d5a4a987ad646b35de3717

SHA1
5d10cbd25ac1c7ced5bfb3d6f185fa150f6ea134

SHA256
1a14f6e1fd11efff72e1863f8645f090eec1b616614460c210c3b7e3c13d4b5e

SHA512
c192ae381008eaf180782e6e40cd51834e0233e98942bd071768308e179f58f3530e6e883f245a2630c86923dbeb68b624c5ec2167040d749813fedc37a6d1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\libcrypto-1_1-x64.dll
Filesize
2.4MB

MD5
8c75bca5ea3bea4d63f52369e3694d01

SHA1
a0c0fd3d9e5688d75386094979171dbde2ce583a

SHA256
8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

SHA512
6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\libssl-1_1-x64.dll
Filesize
511KB

MD5
0205c08024bf4bb892b9f31d751531a0

SHA1
60875676bc6f2494f052769aa7d644ef4a28c5e5

SHA256
ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b

SHA512
45da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\python37.dll
Filesize
3.6MB

MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\select.pyd
Filesize
26KB

MD5
1650617f3378c5bd469906ae1256a54c

SHA1
dd89ffd426b6820fd79631e4c99760cb485d3a67

SHA256
5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

SHA512
89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\sqlite3.dll
Filesize
1.1MB

MD5
05b940cff93d1f624507a1b0f436dc2f

SHA1
ec56591a1d698d592433fe00e3091101c0b3b55b

SHA256
496861a700f2879cf8ae710a6e3eedfcefc3ef6f05936ad1ea928aa1c3919abb

SHA512
4959a68881882c356c2997458a235da80e0f3f0b9bc9fc739967f5c79d78af41d8c5e9af4f8d6fa772f0bd1d5df0a3057ebf492dcc1fa5fa9488019e60b1babf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20362\unicodedata.pyd
Filesize
1.0MB

MD5
2b2156a32b7ef46906517ae49a599c16

SHA1
892134a20f118d9326da6c1b98c01f31d771a5d1

SHA256
2c5f5abf982e8b4bb5e28d217a5e437907acfb7a7e9ee96cd9fa64c4ba304418

SHA512
d6aa25cdfca13db260110b3f34a3d731b325efcaccde5ec36b4f88406841b4ec9c9ab88ad54944eba476772bfd69c3975d9cb1a92994b0ae8e56278353214100

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_bz2.pyd
Filesize
87KB

MD5
429ad9f0d7240a1eb9c108b2d7c1382f

SHA1
f54e1c1d31f5dd6698e47750daf48b9291b9ea69

SHA256
d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

SHA512
bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_hashlib.pyd
Filesize
38KB

MD5
d61618c28373d7bbdf1dec7ec2b2b1c1

SHA1
51f4bab84620752aedf7d71dcccb577ed518e9fd

SHA256
33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

SHA512
ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_lzma.pyd
Filesize
251KB

MD5
5e7a6b749a05dd934ee4471411420053

SHA1
fcd1e54011b98928edbb3820a5838568b9573453

SHA256
4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

SHA512
ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_queue.pyd
Filesize
27KB

MD5
3f536949d0fcae286b08f6a90d4c5198

SHA1
04877dff7e8c994e4875a1b85b7388684b97da25

SHA256
613c0fc66b1f2f8dccb47f24f1578137a99c5a62550719f0402f13337ad5c60a

SHA512
cd59a4a2d839dec513b912e33bd92281a0fdfe0a210ae972cce8b77347e000bb87c8074d8b8cbfeba75158f2b8f3d0669f778fccec0dec936f055616cedbbb4c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_socket.pyd
Filesize
74KB

MD5
7c5c5e6e4ed888dd26c7aa063bb9f88e

SHA1
a7a3694739b27c3d34beb1a9730fc3dcbae6744a

SHA256
2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

SHA512
9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_sqlite3.pyd
Filesize
84KB

MD5
553f11c6b37e39b09cfd700815df38c2

SHA1
b14916bb054e6503efee63d7b0cfc6e43f5cccfc

SHA256
34d101de287a6d1986c9c768ab7839b5cdda0dacd3848481c2aab83e4142b876

SHA512
445d0311a70cc1e9387219468359834e9274db978a227a910539316fab505783de246b26b0517baeb14b9656bedc5434f0be3ea881b9c2a8382a4dea4ecb64aa

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\_ssl.pyd
Filesize
120KB

MD5
a3c9649e68206c25eff2d09a0bd323f0

SHA1
0f485f37ac3960da624b80667410061efe1f888d

SHA256
b9100db5d225c4103f781a6ea4074ce76387467c3a4bba2ac5bfc65870ab6123

SHA512
aeef27bf73cb7dd96b06c3403fc74c108a8a7d80aa25db35a4b1a96b8931aef63b3037a9a51075ead1e5ad1c001d6afe6f3c3e19af30344177fd562751b00d63

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\libcrypto-1_1-x64.dll
Filesize
2.4MB

MD5
8c75bca5ea3bea4d63f52369e3694d01

SHA1
a0c0fd3d9e5688d75386094979171dbde2ce583a

SHA256
8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

SHA512
6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\libssl-1_1-x64.dll
Filesize
511KB

MD5
0205c08024bf4bb892b9f31d751531a0

SHA1
60875676bc6f2494f052769aa7d644ef4a28c5e5

SHA256
ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b

SHA512
45da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\python37.dll
Filesize
3.6MB

MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\select.pyd
Filesize
26KB

MD5
1650617f3378c5bd469906ae1256a54c

SHA1
dd89ffd426b6820fd79631e4c99760cb485d3a67

SHA256
5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

SHA512
89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\sqlite3.dll
Filesize
1.1MB

MD5
05b940cff93d1f624507a1b0f436dc2f

SHA1
ec56591a1d698d592433fe00e3091101c0b3b55b

SHA256
496861a700f2879cf8ae710a6e3eedfcefc3ef6f05936ad1ea928aa1c3919abb

SHA512
4959a68881882c356c2997458a235da80e0f3f0b9bc9fc739967f5c79d78af41d8c5e9af4f8d6fa772f0bd1d5df0a3057ebf492dcc1fa5fa9488019e60b1babf

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20362\unicodedata.pyd
Filesize
1.0MB

MD5
2b2156a32b7ef46906517ae49a599c16

SHA1
892134a20f118d9326da6c1b98c01f31d771a5d1

SHA256
2c5f5abf982e8b4bb5e28d217a5e437907acfb7a7e9ee96cd9fa64c4ba304418

SHA512
d6aa25cdfca13db260110b3f34a3d731b325efcaccde5ec36b4f88406841b4ec9c9ab88ad54944eba476772bfd69c3975d9cb1a92994b0ae8e56278353214100

Download Submit
memory/1156-54-0x0000000000000000-mapping.dmp

Download