Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 21:11
Static task
static1
Behavioral task
behavioral1
Sample
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe
Resource
win7-20220414-en
General
-
Target
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe
-
Size
6.7MB
-
MD5
e5add66413d0531613aaa334c8ab0208
-
SHA1
90f50ce4965ae425f8674d629e6b203111de5fe7
-
SHA256
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d
-
SHA512
6752ebadf2fdaea11dba578610ea39e567358733a7de9d7d07079180dba1a967fdfb86a9d59ead277445bad9197ac94e60ae4119faa9310223e60f9824ba0ae6
Malware Config
Signatures
-
Loads dropped DLL 15 IoCs
Processes:
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exepid process 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 7 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exedescription pid process Token: 35 4724 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exedescription pid process target process PID 3396 wrote to memory of 4724 3396 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe PID 3396 wrote to memory of 4724 3396 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe PID 3396 wrote to memory of 4724 3396 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe 4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe"C:\Users\Admin\AppData\Local\Temp\4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe"C:\Users\Admin\AppData\Local\Temp\4c29fb510cbf9f9ccc9f17ee35cee857173db79055bf1f7140551b956e7a702d.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dllFilesize
84KB
MD5ae96651cfbd18991d186a029cbecb30c
SHA118df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA2561b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
SHA51242a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dllFilesize
84KB
MD5ae96651cfbd18991d186a029cbecb30c
SHA118df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA2561b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
SHA51242a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_bz2.pydFilesize
71KB
MD5ff5ac8fb724edb1635e2ad985f98ee5b
SHA124c4ab38a9d92c0587e540b2a45c938a244ef828
SHA256b94f64fcb49f40682ed794fa1940a1dc0c8a28f24a1768d3bfe774cf75f59b62
SHA512eac95da6496a18fcbd084b34114bcb0e9be3cfa9b55ba121fc09081ecf9e0b20dc9123f06730a687f052ecdf797716024643100bd8c1adbd046db0075ac15956
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_bz2.pydFilesize
71KB
MD5ff5ac8fb724edb1635e2ad985f98ee5b
SHA124c4ab38a9d92c0587e540b2a45c938a244ef828
SHA256b94f64fcb49f40682ed794fa1940a1dc0c8a28f24a1768d3bfe774cf75f59b62
SHA512eac95da6496a18fcbd084b34114bcb0e9be3cfa9b55ba121fc09081ecf9e0b20dc9123f06730a687f052ecdf797716024643100bd8c1adbd046db0075ac15956
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_hashlib.pydFilesize
31KB
MD5e84e1ba269371e439c2d52024aca6535
SHA12abac4b3eb0ab5cbb86efd964089833cd3bd164f
SHA2562fcb297733e6080480ac24cf073ff5e239fb02a1ce9694313c5047f9c58d781b
SHA51222eaa0f42895eba9ab24fe1e33ef6767b2efa18529794d070858f15e116228d087fe7d3db655a564e52eb2ea01bf4a651f0f82417e0fccca8f770057b165d78c
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_hashlib.pydFilesize
31KB
MD5e84e1ba269371e439c2d52024aca6535
SHA12abac4b3eb0ab5cbb86efd964089833cd3bd164f
SHA2562fcb297733e6080480ac24cf073ff5e239fb02a1ce9694313c5047f9c58d781b
SHA51222eaa0f42895eba9ab24fe1e33ef6767b2efa18529794d070858f15e116228d087fe7d3db655a564e52eb2ea01bf4a651f0f82417e0fccca8f770057b165d78c
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_lzma.pydFilesize
180KB
MD565880a33015af2030a08987924ca737b
SHA1931009f59c5639a81bc545c5eff06653cc1aff82
SHA256a71366b95d89d1539a6ee751d48a969c1bca1aa75116424cc5f905f32a625eea
SHA5127099208d7044cae5d9f79ca8c2ef0e0ea4a1066857ddff74d48ff4a6cebc6db679bcde4d64a9925d266542a63889bd300eeb33291db53adcee1df3ad575028db
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_lzma.pydFilesize
180KB
MD565880a33015af2030a08987924ca737b
SHA1931009f59c5639a81bc545c5eff06653cc1aff82
SHA256a71366b95d89d1539a6ee751d48a969c1bca1aa75116424cc5f905f32a625eea
SHA5127099208d7044cae5d9f79ca8c2ef0e0ea4a1066857ddff74d48ff4a6cebc6db679bcde4d64a9925d266542a63889bd300eeb33291db53adcee1df3ad575028db
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_queue.pydFilesize
23KB
MD58807dc228bb761439dc6525a2966e27e
SHA1cb9e8e230eb8a684dec8886a856ec54ff1d2c682
SHA256b7ed6dfb6882e8ec4267d9f80cd5b1dc0a43519382fcb72ab5e74c47875c209d
SHA512def98c22bad3f32ea4caceead743c0fd775cfa4f5287ad8a4728830e10b7352ccc45646e9d8cbffd7d51ae71a6bff1bca38fcefb49c0530a6b69e38edec2ffb3
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_queue.pydFilesize
23KB
MD58807dc228bb761439dc6525a2966e27e
SHA1cb9e8e230eb8a684dec8886a856ec54ff1d2c682
SHA256b7ed6dfb6882e8ec4267d9f80cd5b1dc0a43519382fcb72ab5e74c47875c209d
SHA512def98c22bad3f32ea4caceead743c0fd775cfa4f5287ad8a4728830e10b7352ccc45646e9d8cbffd7d51ae71a6bff1bca38fcefb49c0530a6b69e38edec2ffb3
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_socket.pydFilesize
65KB
MD5a4bd8e0c0597a22c3f0601fe798668aa
SHA15f4a7a23bcdb2d32fb15997536cddfd7f2bf7ca8
SHA25696b0a3cfc16e215f0ef5d1e206f0137b4255005052720e91a58bc98cde8c898e
SHA5127b325ab8b1978b8e8b23aad5714855b96c4c4284f7618475187a8d9043b04c4f79e6953c7d2b03981f34d31e7bd7d21747891d47dedd4f8f7646d3281f779ac0
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_socket.pydFilesize
65KB
MD5a4bd8e0c0597a22c3f0601fe798668aa
SHA15f4a7a23bcdb2d32fb15997536cddfd7f2bf7ca8
SHA25696b0a3cfc16e215f0ef5d1e206f0137b4255005052720e91a58bc98cde8c898e
SHA5127b325ab8b1978b8e8b23aad5714855b96c4c4284f7618475187a8d9043b04c4f79e6953c7d2b03981f34d31e7bd7d21747891d47dedd4f8f7646d3281f779ac0
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_sqlite3.pydFilesize
65KB
MD559c76711cb56c1292f2aed690a89e6a6
SHA1583e820325e3b61ff7f786e75f683b48566acc69
SHA2568d90d6598c3a0ea20beb726fa1e9bcb2e2299e64919fb7bfea3a2a4fcfad16b0
SHA51285bc3f38042653d57d4535a94051c361bf430d015e025eab91df2c5451619d55f7ed7da23a6bc2642e87015c6e8c272920b47aac84d1e5195435344994f2cfc4
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_sqlite3.pydFilesize
65KB
MD559c76711cb56c1292f2aed690a89e6a6
SHA1583e820325e3b61ff7f786e75f683b48566acc69
SHA2568d90d6598c3a0ea20beb726fa1e9bcb2e2299e64919fb7bfea3a2a4fcfad16b0
SHA51285bc3f38042653d57d4535a94051c361bf430d015e025eab91df2c5451619d55f7ed7da23a6bc2642e87015c6e8c272920b47aac84d1e5195435344994f2cfc4
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_ssl.pydFilesize
102KB
MD5cc5c8eb32acb2261c42a7285d436cca9
SHA14845cde2d307e84e3076015a71f8ebc733aa71da
SHA25607ea50e536886f68473635ffefcfcaa7266e63c478ef039ba100ddf02f88ce61
SHA512352f3201a0f47e7741c3c9bfa207769f1afe287a9e9f4e6879d37b2a9cf7fc6ace02ebf0de1ad4a5847134bc3adfeee748f955d8d554b0f552d0e98703c6cd88
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\_ssl.pydFilesize
102KB
MD5cc5c8eb32acb2261c42a7285d436cca9
SHA14845cde2d307e84e3076015a71f8ebc733aa71da
SHA25607ea50e536886f68473635ffefcfcaa7266e63c478ef039ba100ddf02f88ce61
SHA512352f3201a0f47e7741c3c9bfa207769f1afe287a9e9f4e6879d37b2a9cf7fc6ace02ebf0de1ad4a5847134bc3adfeee748f955d8d554b0f552d0e98703c6cd88
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\base_library.zipFilesize
768KB
MD579fd88bdc4204f5ead8c7950abd7152d
SHA1f76d341757d3ba3887217c270ce44a43ac93531b
SHA256341c250bf20f9da7494c4605a63ac65ab2f9c0bbb9bdb61f173b4720ac886c33
SHA512c87c9953e3252f410c7896bd6cbd25b62331de082dfc7c78207b5f198e956d88c214dd0f915e0768fd8ee2ca4b6eeb206737b7ad5a6af22b4d66bd95e99911a5
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\certifi\cacert.pemFilesize
274KB
MD577eef70800962694031e78c7352738d7
SHA1b767d89e989477beb79ba2d5b340b0b4f7ae2192
SHA256732befe49c758070023448f619a3abb088f44e4f05992bc7478dae873be56ad8
SHA5120b3984f7bf9d37648a26ef5d3a93e15d5c2e8a443df123121ba43ca858939346cca0d613f04f2d9aba5420b1291ef429fea84e60920220086b153aac61a20f2f
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\libcrypto-1_1.dllFilesize
2.1MB
MD5c0e55a25dd5c5447f15eed0ca6552ab7
SHA1467bc011e0224df3e6b73ac3b88a97b911cc73b8
SHA2569fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3
SHA512090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\libcrypto-1_1.dllFilesize
2.1MB
MD5c0e55a25dd5c5447f15eed0ca6552ab7
SHA1467bc011e0224df3e6b73ac3b88a97b911cc73b8
SHA2569fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3
SHA512090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\libcrypto-1_1.dllFilesize
2.1MB
MD5c0e55a25dd5c5447f15eed0ca6552ab7
SHA1467bc011e0224df3e6b73ac3b88a97b911cc73b8
SHA2569fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3
SHA512090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\libssl-1_1.dllFilesize
524KB
MD55adb49cc84abd6d3c8f959ca5a146ad7
SHA190faa543515960b2d47554b86d2478105497d853
SHA256f4d5df50bdf3e7304c67c81ace83263c8d0f0e28087c6104c21150bfeda86b8d
SHA512bf184a25e32bea2ac7d76d303562118eaa87bb5cd735142d6aa5a1a9247290d28c45476842e22c61e47a06316595834f8c0ebb35dfc622fe2f02a1e44a91e5d8
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\libssl-1_1.dllFilesize
524KB
MD55adb49cc84abd6d3c8f959ca5a146ad7
SHA190faa543515960b2d47554b86d2478105497d853
SHA256f4d5df50bdf3e7304c67c81ace83263c8d0f0e28087c6104c21150bfeda86b8d
SHA512bf184a25e32bea2ac7d76d303562118eaa87bb5cd735142d6aa5a1a9247290d28c45476842e22c61e47a06316595834f8c0ebb35dfc622fe2f02a1e44a91e5d8
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\python37.dllFilesize
3.4MB
MD5d49eac0faa510f2b2a8934a0f4e4a46f
SHA1bbe4ab5dae01817157e2d187eb2999149a436a12
SHA256625ca7bb2d34a3986f77c0c5ce572a08febfcacf5050a986507e822ff694dcaa
SHA512b17f3370ecd3fe90b928f4a76cbad934b80b96775297acc1181b18ede8f2c8a8301d3298bafa4402bce4138df69d4b57e00e224a4ddbb0d78bb11b217a41a312
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\python37.dllFilesize
3.4MB
MD5d49eac0faa510f2b2a8934a0f4e4a46f
SHA1bbe4ab5dae01817157e2d187eb2999149a436a12
SHA256625ca7bb2d34a3986f77c0c5ce572a08febfcacf5050a986507e822ff694dcaa
SHA512b17f3370ecd3fe90b928f4a76cbad934b80b96775297acc1181b18ede8f2c8a8301d3298bafa4402bce4138df69d4b57e00e224a4ddbb0d78bb11b217a41a312
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\select.pydFilesize
22KB
MD56a796088cd3d1b1d6590364b9372959d
SHA13de080d32b14a88a5e411a52d7b43ff261b2bf5e
SHA25674d8e6a57090ba32cf7c82ad9a275351e421842d6ec94c44adbba629b1893fa7
SHA512582d9a3513724cc197fd2516528bfd8337f73ae1f5206d57f683bf96367881e8d2372be100662c67993edecfbd7e2f903c0be70579806a783267b82f32abd200
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\select.pydFilesize
22KB
MD56a796088cd3d1b1d6590364b9372959d
SHA13de080d32b14a88a5e411a52d7b43ff261b2bf5e
SHA25674d8e6a57090ba32cf7c82ad9a275351e421842d6ec94c44adbba629b1893fa7
SHA512582d9a3513724cc197fd2516528bfd8337f73ae1f5206d57f683bf96367881e8d2372be100662c67993edecfbd7e2f903c0be70579806a783267b82f32abd200
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\sqlite3.dllFilesize
978KB
MD54b70addf2c9dbbccf072c6b899e231cc
SHA1e7e990d3900e56ee2a6d8e417583e39cca378f58
SHA256b9a1c6b40da5aade9f601642d16b4ede7d36e21df159f3caafd68fe7fc04b120
SHA512c15bf73a13ff69b75e957c53a2c7665e50e84864f51ab45e97a0dddf39e30118f94fdb8cd727622b5c74ca72d1c9c4fff4f00b3d5891ad0c51177b46ba074658
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\sqlite3.dllFilesize
978KB
MD54b70addf2c9dbbccf072c6b899e231cc
SHA1e7e990d3900e56ee2a6d8e417583e39cca378f58
SHA256b9a1c6b40da5aade9f601642d16b4ede7d36e21df159f3caafd68fe7fc04b120
SHA512c15bf73a13ff69b75e957c53a2c7665e50e84864f51ab45e97a0dddf39e30118f94fdb8cd727622b5c74ca72d1c9c4fff4f00b3d5891ad0c51177b46ba074658
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\unicodedata.pydFilesize
1.0MB
MD5e176f984d22f031098d700b7f1892378
SHA152842cdd08a3745756054b2278952e036031f5d9
SHA25646876fc52f1529c2633372d8e2cea5b08b5a8582f8645cfad8f5ff8128a7f575
SHA512b9ca5c965bf6b09cd05994340bfc8d006b64c78f0478cc58dffcb2932a4b54f92bc31c34bcbd0692b60adc7d3a31f8a156a2bc84d77379d900926d1e42b181b3
-
C:\Users\Admin\AppData\Local\Temp\_MEI33962\unicodedata.pydFilesize
1.0MB
MD5e176f984d22f031098d700b7f1892378
SHA152842cdd08a3745756054b2278952e036031f5d9
SHA25646876fc52f1529c2633372d8e2cea5b08b5a8582f8645cfad8f5ff8128a7f575
SHA512b9ca5c965bf6b09cd05994340bfc8d006b64c78f0478cc58dffcb2932a4b54f92bc31c34bcbd0692b60adc7d3a31f8a156a2bc84d77379d900926d1e42b181b3
-
memory/4724-130-0x0000000000000000-mapping.dmp