Analysis
-
max time kernel
262s -
max time network
320s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:52
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20221111-en
General
-
Target
main.exe
-
Size
8.8MB
-
MD5
053201aeccd9b16ff10cd400abb63d65
-
SHA1
010923f2c0aaf74143dc2fa9593e1a53cc8f2087
-
SHA256
ea2045421fd15fcd2157fc161bed6e878b9507e13a8a90100092d55a3012f2a1
-
SHA512
01bd3d3a2071b6e303fb02eb980de1c7af8b0c40685dc7e8089abbb313798c6fc1096be1f3f7e429e16d47b9c82af2860509d3b029127e764587a64178bb5f93
-
SSDEEP
196608:dddBvW0bF7FoRE2na0MhCXr3uO1Z3JXLtgZWVkR6muv7z:JB1FeREWalAXr+O1xptUW6ROv
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
Processes:
main.exepid process 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe 4452 main.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
main.exedescription pid process target process PID 4220 wrote to memory of 4452 4220 main.exe main.exe PID 4220 wrote to memory of 4452 4220 main.exe main.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140.dllFilesize
91KB
MD57942be5474a095f673582997ae3054f1
SHA1e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA2568ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA51249fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\VCRUNTIME140.dllFilesize
91KB
MD57942be5474a095f673582997ae3054f1
SHA1e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA2568ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA51249fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_ctypes.pydFilesize
123KB
MD54786508ffadc542bd677f45af820fdb9
SHA1fc0f7dae6e0d093594e4ff1c293ce004dbd16fd7
SHA25664f5072cd9536418ec0fd4b5c30c13b03cdddced1f9332d4d721c4b37ae3883e
SHA512ad4b0e6883c2f0c003c46b1b85f5fbc2c1f8366a212695b9e47664c8735a30d4c8a3c645b324d3d059582096a1fe78ac1043ba8a639ced0665ef8c5cc33d0b80
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_ctypes.pydFilesize
123KB
MD54786508ffadc542bd677f45af820fdb9
SHA1fc0f7dae6e0d093594e4ff1c293ce004dbd16fd7
SHA25664f5072cd9536418ec0fd4b5c30c13b03cdddced1f9332d4d721c4b37ae3883e
SHA512ad4b0e6883c2f0c003c46b1b85f5fbc2c1f8366a212695b9e47664c8735a30d4c8a3c645b324d3d059582096a1fe78ac1043ba8a639ced0665ef8c5cc33d0b80
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_hashlib.pydFilesize
46KB
MD5ef3b935e7d9e1685b84636f908732b06
SHA1968bca85a6f61fa24d53fc6aa77a3f48d2b08dd6
SHA25646d3016b73ecf3713228df563971feefcbebcea9925349a0807b48f0e09877ce
SHA51234c1779b8b7cd8449afaaeabb37a9bbb895c199d06557ea301361972ce4722f3db98e2e099eb2ce52486ab60567ac8041a4b3b3e8e917256bdd9954cbb9b05b3
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_hashlib.pydFilesize
46KB
MD5ef3b935e7d9e1685b84636f908732b06
SHA1968bca85a6f61fa24d53fc6aa77a3f48d2b08dd6
SHA25646d3016b73ecf3713228df563971feefcbebcea9925349a0807b48f0e09877ce
SHA51234c1779b8b7cd8449afaaeabb37a9bbb895c199d06557ea301361972ce4722f3db98e2e099eb2ce52486ab60567ac8041a4b3b3e8e917256bdd9954cbb9b05b3
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_socket.pydFilesize
77KB
MD5bc7b1b0112427976b83911e607213c37
SHA1f4c7eb5b46ebe015a13de59f17ca158c01a377f4
SHA25685f200cb9adf0ef97d40b897868f6ad564211d3529f0b6dfe8e04c56a7b832bc
SHA51218bc94c917ee894121241dcf65fab370a344caaf1120162fcb0966503c502b3e990a79553d2e4e1e3403e35d2b5e00cb365254c08f99c93c178e2e1fd7b2a040
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\_socket.pydFilesize
77KB
MD5bc7b1b0112427976b83911e607213c37
SHA1f4c7eb5b46ebe015a13de59f17ca158c01a377f4
SHA25685f200cb9adf0ef97d40b897868f6ad564211d3529f0b6dfe8e04c56a7b832bc
SHA51218bc94c917ee894121241dcf65fab370a344caaf1120162fcb0966503c502b3e990a79553d2e4e1e3403e35d2b5e00cb365254c08f99c93c178e2e1fd7b2a040
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\base_library.zipFilesize
777KB
MD5387a7c14ffae258fa83cee4b7ff9a082
SHA123855b8284bd4b424378f8044a030d5e4b9c4e09
SHA256d524b36c810c37b8fb7f2bc787d632f356dacf2c837a2103a6f5715db87fd4d0
SHA512eda86fb739318e13c0112338e9749cd0eb68f8c82261ee7477677c21d6bc0faac225c3c07c4e976a205904dc711b2825d2f683700ebf459a36474554802b1543
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libcrypto-1_1.dllFilesize
3.2MB
MD5aa811bb63dbd4c5859b68332326f60b1
SHA16e5584d5c59d2f79cbf60c6c71a92ecd7e4e0977
SHA25600a1eeb37372d11559bf44c9e68af9c841c41c95a173f3dfec4e0b5923d0cae0
SHA512dad9b14f501fd63824480f8801acd4004dd46f7a6965ac8ab91e573676236a11099f4b7cfdf7b3f6c0cc52a3b2e5d9b50f715f53a1f4f858ea2a5eb15d5092cd
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\python3.DLLFilesize
58KB
MD5a7275a8ed51ee00a0fab3501a3cccd2d
SHA10e8306d2dde4806a34170553e2b989104487bc84
SHA256380d45f590f36628663e863f55d8863d78b699ba09b36561d4d7c9914ccab36a
SHA512b4507d6c048e80b1062f9e7f0e6d7266d65feeeeffe5def33137cfac88226652d1d499aee5529385a08cb3666bfe66047fbffd554a9c23dc1c98965b0d9d7a9e
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\python3.dllFilesize
58KB
MD5a7275a8ed51ee00a0fab3501a3cccd2d
SHA10e8306d2dde4806a34170553e2b989104487bc84
SHA256380d45f590f36628663e863f55d8863d78b699ba09b36561d4d7c9914ccab36a
SHA512b4507d6c048e80b1062f9e7f0e6d7266d65feeeeffe5def33137cfac88226652d1d499aee5529385a08cb3666bfe66047fbffd554a9c23dc1c98965b0d9d7a9e
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\python38.dllFilesize
4.0MB
MD5eec355a6e9586f823a4f12bed11e6c80
SHA133627398cb32f4fbb162f38f7c277ad5b13a99ba
SHA256560a6a5f8b7afa99600cc47da26a802c342d7f50ffe23850372f2fcf536cd26f
SHA5127b4b3c13383de62a17aa1aafabce657ea5f4aadd716430fcd6e0f3125b773ae1589b3eaa050ccd87b37f6fae2391c5e7a8a229c0b0fa135de8d0269e9752bea0
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\python38.dllFilesize
4.0MB
MD5eec355a6e9586f823a4f12bed11e6c80
SHA133627398cb32f4fbb162f38f7c277ad5b13a99ba
SHA256560a6a5f8b7afa99600cc47da26a802c342d7f50ffe23850372f2fcf536cd26f
SHA5127b4b3c13383de62a17aa1aafabce657ea5f4aadd716430fcd6e0f3125b773ae1589b3eaa050ccd87b37f6fae2391c5e7a8a229c0b0fa135de8d0269e9752bea0
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\select.pydFilesize
27KB
MD5bb6e9825bd4a98e0700d96b59ec64f68
SHA1afd51547dad9cd7fac0efbda76b5e2388a027681
SHA256bb81d220db83d5276fccda137d430160b8eafd40f4d92d86ebc718b4dfd555ac
SHA5122380a0a2bd625ff79b04bb9d4f6611150512d72f719a3cc73806ea979c29b01fc3d947fb2998e308796a32061e0f2d34d158876924c71350c759e2a841abf964
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\select.pydFilesize
27KB
MD5bb6e9825bd4a98e0700d96b59ec64f68
SHA1afd51547dad9cd7fac0efbda76b5e2388a027681
SHA256bb81d220db83d5276fccda137d430160b8eafd40f4d92d86ebc718b4dfd555ac
SHA5122380a0a2bd625ff79b04bb9d4f6611150512d72f719a3cc73806ea979c29b01fc3d947fb2998e308796a32061e0f2d34d158876924c71350c759e2a841abf964
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\ucrtbase.dllFilesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
C:\Users\Admin\AppData\Local\Temp\_MEI42202\ucrtbase.dllFilesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
memory/4452-132-0x0000000000000000-mapping.dmp