Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe
Resource
win7-20220414-en
General
-
Target
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe
-
Size
6.1MB
-
MD5
f886e708d2ced1e62953d6016c67719e
-
SHA1
19c87be30a63aa5ab074908a8964eac5975ac8c2
-
SHA256
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c
-
SHA512
cbf90b241b0ebbdb104d30ac1659ed6ce002eb1db9c3cf34778c725ab3db92187ca676199075285153f73e030d1bea06d67c72ceb72a792d54890f8558f1b6c1
Malware Config
Signatures
-
Loads dropped DLL 14 IoCs
Processes:
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exepid process 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exedescription pid process Token: 35 4320 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exedescription pid process target process PID 3840 wrote to memory of 4320 3840 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe PID 3840 wrote to memory of 4320 3840 b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe"C:\Users\Admin\AppData\Local\Temp\b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe"C:\Users\Admin\AppData\Local\Temp\b55ccd19c66f900693f45d7e180bde3f2cda393929b0cea81cbc494e4f43ab1c.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_bz2.pydFilesize
87KB
MD5e5ba852cb53065389044fe34474a4699
SHA1d14401c170be8f73de67cfc7ea414dfb1c878ae5
SHA256690bfd170e038b7b369eb4e4e32621823b1050d895bae3ef538c6382cdc1b2b0
SHA512c6db73a39c563ac8395214ba1fa9807542b228ebcf6daef9e5478ba99acfcd8dc3d4816c68c51128bb421e8ee2f4625ec24fbe1ef2d268eb01ce09c37ed27101
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_bz2.pydFilesize
87KB
MD5e5ba852cb53065389044fe34474a4699
SHA1d14401c170be8f73de67cfc7ea414dfb1c878ae5
SHA256690bfd170e038b7b369eb4e4e32621823b1050d895bae3ef538c6382cdc1b2b0
SHA512c6db73a39c563ac8395214ba1fa9807542b228ebcf6daef9e5478ba99acfcd8dc3d4816c68c51128bb421e8ee2f4625ec24fbe1ef2d268eb01ce09c37ed27101
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_hashlib.pydFilesize
38KB
MD5e2f401c211fab8c5e1517764e9175616
SHA17497eb47b63435d60e7d1bf20b2c946335e6671e
SHA25676fb36e23b8f6821caec61c49f90b194632e68c9c78c9eb1f2e668c1b6383a73
SHA5121312eaa7cc46b774392ae9e588c41b104eda43703e48e5b13702e15da665c0e5cc8e21b4011141c63811cd366a0d5773ff26c40c27159b80486bc491eef450a9
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_hashlib.pydFilesize
38KB
MD5e2f401c211fab8c5e1517764e9175616
SHA17497eb47b63435d60e7d1bf20b2c946335e6671e
SHA25676fb36e23b8f6821caec61c49f90b194632e68c9c78c9eb1f2e668c1b6383a73
SHA5121312eaa7cc46b774392ae9e588c41b104eda43703e48e5b13702e15da665c0e5cc8e21b4011141c63811cd366a0d5773ff26c40c27159b80486bc491eef450a9
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_lzma.pydFilesize
251KB
MD5c7bbbab8b4764c1c2bfd480dc649653c
SHA1a5226b44fd42f39948174fab8b6ba5999104d831
SHA25696205c0efbfbc282d3f4b76f8f2f189a409f365dbe9a9a088351a2906b18cd36
SHA512aad92eb554af4a99647c770f8a0e988da78542df348e89b740f5f777b5acd992a896c9790598c2c9df35a4167347653e7b337ac98258b9c878c710582e7c21da
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_lzma.pydFilesize
251KB
MD5c7bbbab8b4764c1c2bfd480dc649653c
SHA1a5226b44fd42f39948174fab8b6ba5999104d831
SHA25696205c0efbfbc282d3f4b76f8f2f189a409f365dbe9a9a088351a2906b18cd36
SHA512aad92eb554af4a99647c770f8a0e988da78542df348e89b740f5f777b5acd992a896c9790598c2c9df35a4167347653e7b337ac98258b9c878c710582e7c21da
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_queue.pydFilesize
27KB
MD5317191c97f22fbdde19cc96faac65075
SHA17f431344d8eb54775fbfd45d41a850b442a3ed8a
SHA2560689472122c4947e14bfed7f9916c109c6ce218d7cbd4ee96dc9c0f787cfaec6
SHA512af86e5b07bf3b2cab09726cfe8be06cbba2de0527ef5e630807d51235a94ba6644939b16d7e194172d05f6913a9e34248112ae790c4de1aa2139e79965b91c6e
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_queue.pydFilesize
27KB
MD5317191c97f22fbdde19cc96faac65075
SHA17f431344d8eb54775fbfd45d41a850b442a3ed8a
SHA2560689472122c4947e14bfed7f9916c109c6ce218d7cbd4ee96dc9c0f787cfaec6
SHA512af86e5b07bf3b2cab09726cfe8be06cbba2de0527ef5e630807d51235a94ba6644939b16d7e194172d05f6913a9e34248112ae790c4de1aa2139e79965b91c6e
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_socket.pydFilesize
74KB
MD59f0683eb56d79d33ee3820f1d3504cc2
SHA10bf7a74e9040bb7ffda943ffef531520a9f419af
SHA25639612c28eef633eef7e2e2c83a779fdda178d043d7aec0a07890e5d2a11cf4f8
SHA512f086cc899b517ace259d27c048db5846552a7a8e57ddad4d6ea0b25b45e52282979309cea56bb56312aa83273b61f78b25b1ad6a61b6b3de33f5980c81ae6f32
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_socket.pydFilesize
74KB
MD59f0683eb56d79d33ee3820f1d3504cc2
SHA10bf7a74e9040bb7ffda943ffef531520a9f419af
SHA25639612c28eef633eef7e2e2c83a779fdda178d043d7aec0a07890e5d2a11cf4f8
SHA512f086cc899b517ace259d27c048db5846552a7a8e57ddad4d6ea0b25b45e52282979309cea56bb56312aa83273b61f78b25b1ad6a61b6b3de33f5980c81ae6f32
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_sqlite3.pydFilesize
83KB
MD571d8d3b5aa31b0bce21c1557bf2df269
SHA14e5b7c44ce996f5e6986d5a1eccb4441fb648590
SHA256440aae80b5026dc0f2d4ad080079dec960d236063b3eef3a456b8fb0c954825d
SHA512b4f536197739431e4d3ad922f2a861c72f43972ab279b17788666642a26cd04a5c0af00124ceb858e69004ecf49535f2b6ca4987c280beda08a89d34a8e5b405
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_sqlite3.pydFilesize
83KB
MD571d8d3b5aa31b0bce21c1557bf2df269
SHA14e5b7c44ce996f5e6986d5a1eccb4441fb648590
SHA256440aae80b5026dc0f2d4ad080079dec960d236063b3eef3a456b8fb0c954825d
SHA512b4f536197739431e4d3ad922f2a861c72f43972ab279b17788666642a26cd04a5c0af00124ceb858e69004ecf49535f2b6ca4987c280beda08a89d34a8e5b405
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_ssl.pydFilesize
120KB
MD5a7fadacb8f4ff72a26f1ccbcfcdc33c1
SHA1e73311cce41f1de6e01e13ef5745febf37fb3193
SHA256b8232c839e99a3701657fe16f245e0afca2f269562682eb1a3468c47d07ac5cf
SHA512a486a2c9fa2cf8a8b8c609a9f4d132c55c39dabcc1ea20455a27e23395515881c9cd396416796762777079aae6c6673dc9905bdcc92ff13d93e7e6c2a06403fe
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\_ssl.pydFilesize
120KB
MD5a7fadacb8f4ff72a26f1ccbcfcdc33c1
SHA1e73311cce41f1de6e01e13ef5745febf37fb3193
SHA256b8232c839e99a3701657fe16f245e0afca2f269562682eb1a3468c47d07ac5cf
SHA512a486a2c9fa2cf8a8b8c609a9f4d132c55c39dabcc1ea20455a27e23395515881c9cd396416796762777079aae6c6673dc9905bdcc92ff13d93e7e6c2a06403fe
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\base_library.zipFilesize
767KB
MD5395b50bcb6b1f17a7c05f7c540c3faa4
SHA1980bffdc6e1f416fcd394b370dc86de2075276e2
SHA2568fecafd8311bb49d67235ea6f1f989fc8dcc21329e7bfc6e43afdc2708447364
SHA512f99bd62b014267d820e56dc78c790747693cfdbbfbd4d724826d3fadac75c2e52ec2c8c24c6fd960afa7c1685ccdbb61683c55dae28a36070a7d2917d4f07aa0
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\certifi\cacert.pemFilesize
274KB
MD577eef70800962694031e78c7352738d7
SHA1b767d89e989477beb79ba2d5b340b0b4f7ae2192
SHA256732befe49c758070023448f619a3abb088f44e4f05992bc7478dae873be56ad8
SHA5120b3984f7bf9d37648a26ef5d3a93e15d5c2e8a443df123121ba43ca858939346cca0d613f04f2d9aba5420b1291ef429fea84e60920220086b153aac61a20f2f
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\libcrypto-1_1-x64.dllFilesize
2.4MB
MD58c75bca5ea3bea4d63f52369e3694d01
SHA1a0c0fd3d9e5688d75386094979171dbde2ce583a
SHA2568513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0
SHA5126d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\libcrypto-1_1-x64.dllFilesize
2.4MB
MD58c75bca5ea3bea4d63f52369e3694d01
SHA1a0c0fd3d9e5688d75386094979171dbde2ce583a
SHA2568513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0
SHA5126d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\libssl-1_1-x64.dllFilesize
511KB
MD50205c08024bf4bb892b9f31d751531a0
SHA160875676bc6f2494f052769aa7d644ef4a28c5e5
SHA256ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b
SHA51245da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\libssl-1_1-x64.dllFilesize
511KB
MD50205c08024bf4bb892b9f31d751531a0
SHA160875676bc6f2494f052769aa7d644ef4a28c5e5
SHA256ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b
SHA51245da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\python37.dllFilesize
3.6MB
MD5d558d4db5a6bd29a8b60b8aa46e5329a
SHA1a5036009de7165b1b4721263eae4b240ee689095
SHA2561cfdd40a9107d89310e4e3b6df5f25f26944b312e61638d014f1b1a8050ccc07
SHA5125590fbd6c9c81293b21e9da9d35d5177f03ba3d247771e4abef3420420d9024f3a775796d73becd5aeb469df648d3105a016693c6b8f68e8c61399212439eebf
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\python37.dllFilesize
3.6MB
MD5d558d4db5a6bd29a8b60b8aa46e5329a
SHA1a5036009de7165b1b4721263eae4b240ee689095
SHA2561cfdd40a9107d89310e4e3b6df5f25f26944b312e61638d014f1b1a8050ccc07
SHA5125590fbd6c9c81293b21e9da9d35d5177f03ba3d247771e4abef3420420d9024f3a775796d73becd5aeb469df648d3105a016693c6b8f68e8c61399212439eebf
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\select.pydFilesize
26KB
MD5cf7bd630db53356c3dfd51ca8822b696
SHA1202837642baa0d161d462039ab2441d491c6fe5f
SHA2565ed33afc7f63de065457e0ef0852de0cc182a7111bd852e855eb9f48451b0e58
SHA5124c32e03b670fa42f57e5e265e56e9845b719286ffecd8afcd583649fee11b803776f15ea28730925dc0c0b5510c18047ceda951fca1a716a1acc54f0dbc9e91a
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\select.pydFilesize
26KB
MD5cf7bd630db53356c3dfd51ca8822b696
SHA1202837642baa0d161d462039ab2441d491c6fe5f
SHA2565ed33afc7f63de065457e0ef0852de0cc182a7111bd852e855eb9f48451b0e58
SHA5124c32e03b670fa42f57e5e265e56e9845b719286ffecd8afcd583649fee11b803776f15ea28730925dc0c0b5510c18047ceda951fca1a716a1acc54f0dbc9e91a
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\sqlite3.dllFilesize
1.1MB
MD5e0faa2ddf1c05dabe10de1c4bfa6f705
SHA1cc0aefb96654947a2081fe144c0c76438e4b77dc
SHA25680830fe350e383dfec02b4ce090a14f9e1415e830c5c8fd9a2133e141c33ca5c
SHA51270b3db39a69ed52135ccb067326daa2b830ac9e7d2107cb5538ebf0b049112eb3e7bef84e025a531554f35e0e43dbb4c84057c33ff1c9af7e8cabb579c117b2c
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\sqlite3.dllFilesize
1.1MB
MD5e0faa2ddf1c05dabe10de1c4bfa6f705
SHA1cc0aefb96654947a2081fe144c0c76438e4b77dc
SHA25680830fe350e383dfec02b4ce090a14f9e1415e830c5c8fd9a2133e141c33ca5c
SHA51270b3db39a69ed52135ccb067326daa2b830ac9e7d2107cb5538ebf0b049112eb3e7bef84e025a531554f35e0e43dbb4c84057c33ff1c9af7e8cabb579c117b2c
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\token gen2.exe.manifestFilesize
1KB
MD5581b7b4416ec38aabb93c4052f026e27
SHA15e620bc0ba3a4b7f75ea579c3cd0fdf5b6b45ab5
SHA2566b79fc58698bb055f3106b8136e74dd91ba961f04baacdde2842aa9b863b3b20
SHA51207c0ea1f4c0a8363b29fc6a99e8a697a60d3b50fcd98512673fbce25e0421f59068e54e75e48dad433833d33d7395d4345b68ce5ffcecdbc5a367249cad84ec4
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\unicodedata.pydFilesize
1.0MB
MD5d009552163b6a795e0816ea5ce4928ce
SHA1f3640f46037735667b6eba057f89a978a3901430
SHA2565938061557e920e925a4e9b31f950b6d25c5ff10e143fe8e1f773466810ce2a2
SHA5125ed7513a843d2e239aae8a4ce9cbb42366d9f2a0ea5adaedd8dd8c53493594ee3b5b118f766cc04d47d3eb31ec03eeb77b0dc05851de5a585f6970830b6e8580
-
C:\Users\Admin\AppData\Local\Temp\_MEI38402\unicodedata.pydFilesize
1.0MB
MD5d009552163b6a795e0816ea5ce4928ce
SHA1f3640f46037735667b6eba057f89a978a3901430
SHA2565938061557e920e925a4e9b31f950b6d25c5ff10e143fe8e1f773466810ce2a2
SHA5125ed7513a843d2e239aae8a4ce9cbb42366d9f2a0ea5adaedd8dd8c53493594ee3b5b118f766cc04d47d3eb31ec03eeb77b0dc05851de5a585f6970830b6e8580
-
memory/4320-130-0x0000000000000000-mapping.dmp