Overview

overview

7

Static

static

3

Notr.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    54s
  • max time network
    65s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/09/2022, 17:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Notr.exe

  • Size

    6.8MB

  • MD5

    73f6dc1edb2aa4401c82cd92b4eabad0

  • SHA1

    cf1b79cd5349729ebdaf8af4adbee8f44aa8258c

  • SHA256

    506e05332e3bdb84e3bc0846e7ae411d0ecf64ec3421c0f07eff51fb0e600a3b

  • SHA512

    6282c2e0dc2c64111341f2520f8e1d75f1acb2a6bb7ba0ca5cdcf89568d989c8e290ddf24c3aa9c4504b8f7e7235aa175d5d2798c9c4e89e189800f5f4939fa7

  • SSDEEP

    196608:YJOcjsjOCsXDjDyfQydJolpPgToa10/IUFOnJ5JeU:AFsjOCEDXMJ83a10QUsde

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Notr.exe
    "C:\Users\Admin\AppData\Local\Temp\Notr.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Local\Temp\Notr.exe
      "C:\Users\Admin\AppData\Local\Temp\Notr.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2076
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3360

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
        Filesize

        93KB

        MD5

        4a365ffdbde27954e768358f4a4ce82e

        SHA1

        a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

        SHA256

        6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

        SHA512

        54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
        Filesize

        85KB

        MD5

        a49c5f406456b79254eb65d015b81088

        SHA1

        cfc2a2a89c63df52947af3610e4d9b8999399c91

        SHA256

        ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced

        SHA512

        bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
        Filesize

        124KB

        MD5

        291a0a9b63bae00a4222a6df71a22023

        SHA1

        7a6a2aad634ec30e8edb2d2d8d0895c708d84551

        SHA256

        820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324

        SHA512

        d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
        Filesize

        46KB

        MD5

        5e5af52f42eaf007e3ac73fd2211f048

        SHA1

        1a981e66ab5b03f4a74a6bac6227cd45df78010b

        SHA256

        a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b

        SHA512

        bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
        Filesize

        159KB

        MD5

        cf9fd17b1706f3044a8f74f6d398d5f1

        SHA1

        c5cd0debbde042445b9722a676ff36a0ac3959ad

        SHA256

        9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4

        SHA512

        5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_pytransform.dll
        Filesize

        1.1MB

        MD5

        b1209990dd26012617882b10e587630b

        SHA1

        75a85d82d7e69fb8c128cff5970ba2f2d2732dac

        SHA256

        b21af7e2367fa8b87ea46a70acc3bf5e7bb8fcc13c28532170a30870d89258ba

        SHA512

        d1fb99ab4cdc8c24be2613d1df064ec108af831a42d4f8141459c65f2224b7ab8afa38a94dabb90111235ef0b6ab1826b00bac2609402a9b09ea9ba6f08c9588

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_socket.pyd
        Filesize

        78KB

        MD5

        4827652de133c83fa1cae839b361856c

        SHA1

        182f9a04bdc42766cfd5fb352f2cb22e5c26665e

        SHA256

        87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba

        SHA512

        8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\base_library.zip
        Filesize

        1008KB

        MD5

        24036a8677bdaa5d94ac05fd4cf6023e

        SHA1

        eb1596657871cdfca0f7d56c1da39bc99cc903d3

        SHA256

        3bb7a3d471a1be3ba487895e5e60bebca068711639e6a54978bfdf1bdde2f82f

        SHA512

        2982b1b5e5e59d0fd25fe2eb1dafef581151376baa5fdf558d175ddd587b46346839f40c4fae24ccb73ff5aca01c93175227e0c430e42e5c2ef2b3480eb3e0f4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-1_1.dll
        Filesize

        3.2MB

        MD5

        89511df61678befa2f62f5025c8c8448

        SHA1

        df3961f833b4964f70fcf1c002d9fd7309f53ef8

        SHA256

        296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

        SHA512

        9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libffi-7.dll
        Filesize

        32KB

        MD5

        eef7981412be8ea459064d3090f4b3aa

        SHA1

        c60da4830ce27afc234b3c3014c583f7f0a5a925

        SHA256

        f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

        SHA512

        dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\psutil\_psutil_windows.cp38-win_amd64.pyd
        Filesize

        68KB

        MD5

        9b23847e180b39a2de874f216214b57b

        SHA1

        268f1a735cd38ef4ae5c67dcf4d1dcc12abc8732

        SHA256

        8a2c2eef3f72869d612d9ce8dcc2bf72130d766cf49f6f41a7782e618fdc96fe

        SHA512

        588943cde3c018912ffb2efb69e9e218143122c369445275977c8a12eab3100ff8f15f5d794c3db9d63062905d728ad9cbb9c9fe4683dd5b9d583f099ba39f78

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\python38.dll
        Filesize

        4.0MB

        MD5

        26ba25d468a778d37f1a24f4514d9814

        SHA1

        b64fe169690557656ede3ae50d3c5a197fea6013

        SHA256

        2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128

        SHA512

        80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
        Filesize

        27KB

        MD5

        e21cff76db11c1066fd96af86332b640

        SHA1

        e78ef7075c479b1d218132d89bf4bec13d54c06a

        SHA256

        fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28

        SHA512

        e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\ucrtbase.dll
        Filesize

        1.1MB

        MD5

        3b337c2d41069b0a1e43e30f891c3813

        SHA1

        ebee2827b5cb153cbbb51c9718da1549fa80fc5c

        SHA256

        c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

        SHA512

        fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
        Filesize

        93KB

        MD5

        4a365ffdbde27954e768358f4a4ce82e

        SHA1

        a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

        SHA256

        6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

        SHA512

        54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
        Filesize

        85KB

        MD5

        a49c5f406456b79254eb65d015b81088

        SHA1

        cfc2a2a89c63df52947af3610e4d9b8999399c91

        SHA256

        ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced

        SHA512

        bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
        Filesize

        124KB

        MD5

        291a0a9b63bae00a4222a6df71a22023

        SHA1

        7a6a2aad634ec30e8edb2d2d8d0895c708d84551

        SHA256

        820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324

        SHA512

        d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
        Filesize

        46KB

        MD5

        5e5af52f42eaf007e3ac73fd2211f048

        SHA1

        1a981e66ab5b03f4a74a6bac6227cd45df78010b

        SHA256

        a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b

        SHA512

        bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
        Filesize

        159KB

        MD5

        cf9fd17b1706f3044a8f74f6d398d5f1

        SHA1

        c5cd0debbde042445b9722a676ff36a0ac3959ad

        SHA256

        9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4

        SHA512

        5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_pytransform.dll
        Filesize

        1.1MB

        MD5

        b1209990dd26012617882b10e587630b

        SHA1

        75a85d82d7e69fb8c128cff5970ba2f2d2732dac

        SHA256

        b21af7e2367fa8b87ea46a70acc3bf5e7bb8fcc13c28532170a30870d89258ba

        SHA512

        d1fb99ab4cdc8c24be2613d1df064ec108af831a42d4f8141459c65f2224b7ab8afa38a94dabb90111235ef0b6ab1826b00bac2609402a9b09ea9ba6f08c9588

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\_socket.pyd
        Filesize

        78KB

        MD5

        4827652de133c83fa1cae839b361856c

        SHA1

        182f9a04bdc42766cfd5fb352f2cb22e5c26665e

        SHA256

        87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba

        SHA512

        8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-1_1.dll
        Filesize

        3.2MB

        MD5

        89511df61678befa2f62f5025c8c8448

        SHA1

        df3961f833b4964f70fcf1c002d9fd7309f53ef8

        SHA256

        296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

        SHA512

        9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\libffi-7.dll
        Filesize

        32KB

        MD5

        eef7981412be8ea459064d3090f4b3aa

        SHA1

        c60da4830ce27afc234b3c3014c583f7f0a5a925

        SHA256

        f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

        SHA512

        dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\psutil\_psutil_windows.cp38-win_amd64.pyd
        Filesize

        68KB

        MD5

        9b23847e180b39a2de874f216214b57b

        SHA1

        268f1a735cd38ef4ae5c67dcf4d1dcc12abc8732

        SHA256

        8a2c2eef3f72869d612d9ce8dcc2bf72130d766cf49f6f41a7782e618fdc96fe

        SHA512

        588943cde3c018912ffb2efb69e9e218143122c369445275977c8a12eab3100ff8f15f5d794c3db9d63062905d728ad9cbb9c9fe4683dd5b9d583f099ba39f78

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\python38.dll
        Filesize

        4.0MB

        MD5

        26ba25d468a778d37f1a24f4514d9814

        SHA1

        b64fe169690557656ede3ae50d3c5a197fea6013

        SHA256

        2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128

        SHA512

        80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
        Filesize

        27KB

        MD5

        e21cff76db11c1066fd96af86332b640

        SHA1

        e78ef7075c479b1d218132d89bf4bec13d54c06a

        SHA256

        fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28

        SHA512

        e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

        Download Submit

      • \Users\Admin\AppData\Local\Temp\_MEI10042\ucrtbase.dll
        Filesize

        1.1MB

        MD5

        3b337c2d41069b0a1e43e30f891c3813

        SHA1

        ebee2827b5cb153cbbb51c9718da1549fa80fc5c

        SHA256

        c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

        SHA512

        fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

        Download Submit