Overview

overview

9

Static

static

3

GetPassword.exe

windows10-2004_x64

9

Analysis

  • max time kernel
    45s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-05-2022 03:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GetPassword.exe

  • Size

    4.0MB

  • MD5

    44e01e829eeebedb40eae133b103675b

  • SHA1

    23c615b31780c5becefa62cf6daba9f3b89e24d3

  • SHA256

    4247283b43b6801f1537d5addbcdaad7427ff2ef5296fadd4b1214a0ae25f027

  • SHA512

    8767990fe423389a811801c369713222885ad869a3944bf47c0f8feb79ec05e14aa3cbbbf22b41014bd8571d38ea8e2731acba0765830539b4156f5df6ccb969

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GetPassword.exe
    "C:\Users\Admin\AppData\Local\Temp\GetPassword.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Users\Admin\AppData\Local\Temp\GetPassword.exe
      "C:\Users\Admin\AppData\Local\Temp\GetPassword.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\VCRUNTIME140.dll
    Filesize

    81KB

    MD5

    aeab74db6bc6c914997f1a8a9ff013ec

    SHA1

    6b717f23227d158d6aa566498c438b8f305a29b5

    SHA256

    18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

    SHA512

    a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\VCRUNTIME140.dll
    Filesize

    81KB

    MD5

    aeab74db6bc6c914997f1a8a9ff013ec

    SHA1

    6b717f23227d158d6aa566498c438b8f305a29b5

    SHA256

    18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

    SHA512

    a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\_ctypes.pyd
    Filesize

    47KB

    MD5

    80c6c5f414828534b627d4f1d49441b9

    SHA1

    be4e075f349c283e9fe28bacd587ea2f15b8b9d9

    SHA256

    593fa1098c61ae4a075444202cd51700a96813562270f0ac069cf12b3568fbe5

    SHA512

    885daec7c9b7fac16837d5a8f8f40998febaea212a4a61bc76667e12352be4ae80f8186c5e0a5458f2aef07232297b679c275c5d77a9e3bd811f34bcc10e2c4e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\_ctypes.pyd
    Filesize

    47KB

    MD5

    80c6c5f414828534b627d4f1d49441b9

    SHA1

    be4e075f349c283e9fe28bacd587ea2f15b8b9d9

    SHA256

    593fa1098c61ae4a075444202cd51700a96813562270f0ac069cf12b3568fbe5

    SHA512

    885daec7c9b7fac16837d5a8f8f40998febaea212a4a61bc76667e12352be4ae80f8186c5e0a5458f2aef07232297b679c275c5d77a9e3bd811f34bcc10e2c4e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\base_library.zip
    Filesize

    777KB

    MD5

    ca531de5744f22c704de726bd3353404

    SHA1

    bc19aa77ad9bbac86bae3a7209bca5fc2d602ed3

    SHA256

    a50f524eed66843246d6fdb765fb5a96c33b4aa4aab2efda7c11592c2ef80606

    SHA512

    42e19ee714e2d7de0ed29645d21c50946abd90cec29d04bf1a6a7fba26cbe664b1c3bae55fa011b58d7ea33736e2a1667615abc93ad89f976591d8ccfcf4ff2c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\python37.dll
    Filesize

    1.0MB

    MD5

    6c6380043c7571b9090804178a200f1b

    SHA1

    9cb4e31a84dcb8bd2525628778c376db67108418

    SHA256

    24529874761bb931bca4cd8816841c946762b5b3db1c0f77129d004902d0f10b

    SHA512

    140845dfed436f5bc0258132c5bf1fcd50f8ccd9f3804a48d3a534e978729ef5268e8146b0f5ab0ab5c3e52d194bb1eb33cd0a85e9cf125d07cf2956b053c3a9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\_MEI46922\python37.dll
    Filesize

    1.0MB

    MD5

    6c6380043c7571b9090804178a200f1b

    SHA1

    9cb4e31a84dcb8bd2525628778c376db67108418

    SHA256

    24529874761bb931bca4cd8816841c946762b5b3db1c0f77129d004902d0f10b

    SHA512

    140845dfed436f5bc0258132c5bf1fcd50f8ccd9f3804a48d3a534e978729ef5268e8146b0f5ab0ab5c3e52d194bb1eb33cd0a85e9cf125d07cf2956b053c3a9

    Download Submit
  • memory/4388-130-0x0000000000000000-mapping.dmp
    Download