fbc7270e46dccaae9cc0c07441d5c5248463e237845a8334241147182b2f618c

Analysis

max time kernel
37s
max time network
40s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-02-2023 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

theif.exe
Size

20.9MB
MD5

60b946877ef1b74c508aa163c442162c
SHA1

1971af2feec5c2c26ec60c5c9a8d600d8c41ac71
SHA256

fbc7270e46dccaae9cc0c07441d5c5248463e237845a8334241147182b2f618c
SHA512

9b6f3ab377e743122c80dd84fb146a28fe87b1bd21cd7475839ca32b558b8c05b967d273f78fb311a63016c7b58ad9062d196702aca747632daaea84de17f57e
SSDEEP

393216:VhoVRsiaZS9dM/ISWdQ2lH/m3pI+9J5eX/H4i5/Z4JH3qXeSI:VhoHsiakT6ISWdQ0KX9J5eX/Y/a

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

theif.exe

pid process

1284 theif.exe
1284 theif.exe
1284 theif.exe
1284 theif.exe
1284 theif.exe
1284 theif.exe
1284 theif.exe

pid	process
1284	theif.exe
1284	theif.exe
1284	theif.exe
1284	theif.exe
1284	theif.exe
1284	theif.exe
1284	theif.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

theif.exe

description	pid	process	target process
PID 1268 wrote to memory of 1284	1268	theif.exe	theif.exe
PID 1268 wrote to memory of 1284	1268	theif.exe	theif.exe
PID 1268 wrote to memory of 1284	1268	theif.exe	theif.exe

C:\Users\Admin\AppData\Local\Temp\theif.exe
"C:\Users\Admin\AppData\Local\Temp\theif.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\theif.exe
"C:\Users\Admin\AppData\Local\Temp\theif.exe"
2⤵
- Loads dropped DLL
PID:1284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dll
Filesize
21KB

MD5
4454791276f4716342de12eaa6ab5007

SHA1
cfeab7a4aed07adf0e22bb40ca408046896173fa

SHA256
0545cfcb511dcca7764a31465c211ff3d6b91ed5070c00a8613599edff4b7979

SHA512
e86ae200f473ffc00b4e4f3fcdb094cdf896184dd048aed3c408f145282cf5da67889e11334460984c60f332d2faecf9a89a5f3774c81b488aeaadb5e1520497

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-localization-l1-2-0.dll
Filesize
21KB

MD5
584935f54f7a9947a2fec9a6d827e558

SHA1
3ee71afa08464bab300983a2bc627cd791d574dc

SHA256
78b921153dd5776295b464f6b887d6cf3e24097d53305a0c584256b8f569f9fb

SHA512
933658ceeb0a79d968b1ad32fa392f0e9f630c0264919fc729986f0d97ce72c5e5c554a42c068eacbbea24e4adca686ce10701803c6e80c77f7ed6d121cff749

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
21KB

MD5
fb60a721cfca0b3307067a7db90a996e

SHA1
fd4d776f3b9f1f7b658a2abdb5d321721eb19488

SHA256
2f031764abb092fa03732d27876a29f62d40ba0fdce08b66559915dc2879d10c

SHA512
b510c8a1436463ee4206cc6d3585a883bb195cdb3ed134eda286939ba50027ae2c01e409654252966717ccb0fbd2d09aae9d9412fa94491bf403103e7b62a5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-timezone-l1-1-0.dll
Filesize
21KB

MD5
9be41c3476bdf52936e25368c14b87c4

SHA1
22a068671f0e3fc9041a193158cfb95fa3618419

SHA256
9c208b51ad3331ae87ce2642d9a8b119add74798524ea1c3cb1e995045f452b9

SHA512
0756986284b8ea16cc1d35c8a87352e70b7b44a892b3b4a1266c64607aa0dd161e5da4b0286c6dbb38f040d538c85e6c4af26148a31d1382f86b12b4b389463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\python311.dll
Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12682\ucrtbase.dll
Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dll
Filesize
21KB

MD5
4454791276f4716342de12eaa6ab5007

SHA1
cfeab7a4aed07adf0e22bb40ca408046896173fa

SHA256
0545cfcb511dcca7764a31465c211ff3d6b91ed5070c00a8613599edff4b7979

SHA512
e86ae200f473ffc00b4e4f3fcdb094cdf896184dd048aed3c408f145282cf5da67889e11334460984c60f332d2faecf9a89a5f3774c81b488aeaadb5e1520497

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-localization-l1-2-0.dll
Filesize
21KB

MD5
584935f54f7a9947a2fec9a6d827e558

SHA1
3ee71afa08464bab300983a2bc627cd791d574dc

SHA256
78b921153dd5776295b464f6b887d6cf3e24097d53305a0c584256b8f569f9fb

SHA512
933658ceeb0a79d968b1ad32fa392f0e9f630c0264919fc729986f0d97ce72c5e5c554a42c068eacbbea24e4adca686ce10701803c6e80c77f7ed6d121cff749

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
21KB

MD5
fb60a721cfca0b3307067a7db90a996e

SHA1
fd4d776f3b9f1f7b658a2abdb5d321721eb19488

SHA256
2f031764abb092fa03732d27876a29f62d40ba0fdce08b66559915dc2879d10c

SHA512
b510c8a1436463ee4206cc6d3585a883bb195cdb3ed134eda286939ba50027ae2c01e409654252966717ccb0fbd2d09aae9d9412fa94491bf403103e7b62a5bb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\api-ms-win-core-timezone-l1-1-0.dll
Filesize
21KB

MD5
9be41c3476bdf52936e25368c14b87c4

SHA1
22a068671f0e3fc9041a193158cfb95fa3618419

SHA256
9c208b51ad3331ae87ce2642d9a8b119add74798524ea1c3cb1e995045f452b9

SHA512
0756986284b8ea16cc1d35c8a87352e70b7b44a892b3b4a1266c64607aa0dd161e5da4b0286c6dbb38f040d538c85e6c4af26148a31d1382f86b12b4b389463d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\python311.dll
Filesize
5.5MB

MD5
a72993488cecd88b3e19487d646f88f6

SHA1
5d359f4121e0be04a483f9ad1d8203ffc958f9a0

SHA256
aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038

SHA512
c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12682\ucrtbase.dll
Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
memory/1268-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads