506e05332e3bdb84e3bc0846e7ae411d0ecf64ec3421c0f07eff51fb0e600a3b

Analysis

max time kernel
54s
max time network
65s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
28-09-2022 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Notr.exe
Size

6.8MB
MD5

73f6dc1edb2aa4401c82cd92b4eabad0
SHA1

cf1b79cd5349729ebdaf8af4adbee8f44aa8258c
SHA256

506e05332e3bdb84e3bc0846e7ae411d0ecf64ec3421c0f07eff51fb0e600a3b
SHA512

6282c2e0dc2c64111341f2520f8e1d75f1acb2a6bb7ba0ca5cdcf89568d989c8e290ddf24c3aa9c4504b8f7e7235aa175d5d2798c9c4e89e189800f5f4939fa7
SSDEEP

196608:YJOcjsjOCsXDjDyfQydJolpPgToa10/IUFOnJ5JeU:AFsjOCEDXMJ83a10QUsde

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 13 IoCs

Processes:

Notr.exe

pid	process
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe
4812	Notr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Notr.exe

pid process

4812 Notr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Notr.exe

description pid process

Token: SeDebugPrivilege 4812 Notr.exe

description	pid	process
Token: SeDebugPrivilege	4812	Notr.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Notr.exeNotr.exe

description	pid	process	target process
PID 1004 wrote to memory of 4812	1004	Notr.exe	Notr.exe
PID 1004 wrote to memory of 4812	1004	Notr.exe	Notr.exe
PID 4812 wrote to memory of 2076	4812	Notr.exe	cmd.exe
PID 4812 wrote to memory of 2076	4812	Notr.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Notr.exe
"C:\Users\Admin\AppData\Local\Temp\Notr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\Notr.exe
"C:\Users\Admin\AppData\Local\Temp\Notr.exe"
2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:2076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
Filesize
93KB

MD5
4a365ffdbde27954e768358f4a4ce82e

SHA1
a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

SHA256
6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

SHA512
54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
Filesize
85KB

MD5
a49c5f406456b79254eb65d015b81088

SHA1
cfc2a2a89c63df52947af3610e4d9b8999399c91

SHA256
ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced

SHA512
bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
Filesize
124KB

MD5
291a0a9b63bae00a4222a6df71a22023

SHA1
7a6a2aad634ec30e8edb2d2d8d0895c708d84551

SHA256
820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324

SHA512
d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
Filesize
46KB

MD5
5e5af52f42eaf007e3ac73fd2211f048

SHA1
1a981e66ab5b03f4a74a6bac6227cd45df78010b

SHA256
a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b

SHA512
bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
Filesize
159KB

MD5
cf9fd17b1706f3044a8f74f6d398d5f1

SHA1
c5cd0debbde042445b9722a676ff36a0ac3959ad

SHA256
9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4

SHA512
5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_pytransform.dll
Filesize
1.1MB

MD5
b1209990dd26012617882b10e587630b

SHA1
75a85d82d7e69fb8c128cff5970ba2f2d2732dac

SHA256
b21af7e2367fa8b87ea46a70acc3bf5e7bb8fcc13c28532170a30870d89258ba

SHA512
d1fb99ab4cdc8c24be2613d1df064ec108af831a42d4f8141459c65f2224b7ab8afa38a94dabb90111235ef0b6ab1826b00bac2609402a9b09ea9ba6f08c9588

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\_socket.pyd
Filesize
78KB

MD5
4827652de133c83fa1cae839b361856c

SHA1
182f9a04bdc42766cfd5fb352f2cb22e5c26665e

SHA256
87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba

SHA512
8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\base_library.zip
Filesize
1008KB

MD5
24036a8677bdaa5d94ac05fd4cf6023e

SHA1
eb1596657871cdfca0f7d56c1da39bc99cc903d3

SHA256
3bb7a3d471a1be3ba487895e5e60bebca068711639e6a54978bfdf1bdde2f82f

SHA512
2982b1b5e5e59d0fd25fe2eb1dafef581151376baa5fdf558d175ddd587b46346839f40c4fae24ccb73ff5aca01c93175227e0c430e42e5c2ef2b3480eb3e0f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-1_1.dll
Filesize
3.2MB

MD5
89511df61678befa2f62f5025c8c8448

SHA1
df3961f833b4964f70fcf1c002d9fd7309f53ef8

SHA256
296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

SHA512
9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\psutil\_psutil_windows.cp38-win_amd64.pyd
Filesize
68KB

MD5
9b23847e180b39a2de874f216214b57b

SHA1
268f1a735cd38ef4ae5c67dcf4d1dcc12abc8732

SHA256
8a2c2eef3f72869d612d9ce8dcc2bf72130d766cf49f6f41a7782e618fdc96fe

SHA512
588943cde3c018912ffb2efb69e9e218143122c369445275977c8a12eab3100ff8f15f5d794c3db9d63062905d728ad9cbb9c9fe4683dd5b9d583f099ba39f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\python38.dll
Filesize
4.0MB

MD5
26ba25d468a778d37f1a24f4514d9814

SHA1
b64fe169690557656ede3ae50d3c5a197fea6013

SHA256
2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128

SHA512
80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
Filesize
27KB

MD5
e21cff76db11c1066fd96af86332b640

SHA1
e78ef7075c479b1d218132d89bf4bec13d54c06a

SHA256
fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28

SHA512
e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI10042\ucrtbase.dll
Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
Filesize
93KB

MD5
4a365ffdbde27954e768358f4a4ce82e

SHA1
a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

SHA256
6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

SHA512
54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
Filesize
85KB

MD5
a49c5f406456b79254eb65d015b81088

SHA1
cfc2a2a89c63df52947af3610e4d9b8999399c91

SHA256
ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced

SHA512
bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
Filesize
124KB

MD5
291a0a9b63bae00a4222a6df71a22023

SHA1
7a6a2aad634ec30e8edb2d2d8d0895c708d84551

SHA256
820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324

SHA512
d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
Filesize
46KB

MD5
5e5af52f42eaf007e3ac73fd2211f048

SHA1
1a981e66ab5b03f4a74a6bac6227cd45df78010b

SHA256
a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b

SHA512
bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
Filesize
159KB

MD5
cf9fd17b1706f3044a8f74f6d398d5f1

SHA1
c5cd0debbde042445b9722a676ff36a0ac3959ad

SHA256
9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4

SHA512
5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_pytransform.dll
Filesize
1.1MB

MD5
b1209990dd26012617882b10e587630b

SHA1
75a85d82d7e69fb8c128cff5970ba2f2d2732dac

SHA256
b21af7e2367fa8b87ea46a70acc3bf5e7bb8fcc13c28532170a30870d89258ba

SHA512
d1fb99ab4cdc8c24be2613d1df064ec108af831a42d4f8141459c65f2224b7ab8afa38a94dabb90111235ef0b6ab1826b00bac2609402a9b09ea9ba6f08c9588

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\_socket.pyd
Filesize
78KB

MD5
4827652de133c83fa1cae839b361856c

SHA1
182f9a04bdc42766cfd5fb352f2cb22e5c26665e

SHA256
87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba

SHA512
8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-1_1.dll
Filesize
3.2MB

MD5
89511df61678befa2f62f5025c8c8448

SHA1
df3961f833b4964f70fcf1c002d9fd7309f53ef8

SHA256
296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

SHA512
9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\psutil\_psutil_windows.cp38-win_amd64.pyd
Filesize
68KB

MD5
9b23847e180b39a2de874f216214b57b

SHA1
268f1a735cd38ef4ae5c67dcf4d1dcc12abc8732

SHA256
8a2c2eef3f72869d612d9ce8dcc2bf72130d766cf49f6f41a7782e618fdc96fe

SHA512
588943cde3c018912ffb2efb69e9e218143122c369445275977c8a12eab3100ff8f15f5d794c3db9d63062905d728ad9cbb9c9fe4683dd5b9d583f099ba39f78

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\python38.dll
Filesize
4.0MB

MD5
26ba25d468a778d37f1a24f4514d9814

SHA1
b64fe169690557656ede3ae50d3c5a197fea6013

SHA256
2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128

SHA512
80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
Filesize
27KB

MD5
e21cff76db11c1066fd96af86332b640

SHA1
e78ef7075c479b1d218132d89bf4bec13d54c06a

SHA256
fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28

SHA512
e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10042\ucrtbase.dll
Filesize
1.1MB

MD5
3b337c2d41069b0a1e43e30f891c3813

SHA1
ebee2827b5cb153cbbb51c9718da1549fa80fc5c

SHA256
c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

SHA512
fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

Download Submit
memory/2076-135-0x0000000000000000-mapping.dmp

Download
memory/4812-117-0x0000000000000000-mapping.dmp

Download