Analysis

  • max time kernel
    99s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2023 08:17

General

  • Target

    797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b.exe

  • Size

    5.6MB

  • MD5

    b2bb5613b09ba5052aad59fd644d29a6

  • SHA1

    95150e2a0ac157a2f80ddbc27415b68053bfa1bc

  • SHA256

    797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b

  • SHA512

    a4d89ae20ee7965c63646801536b56150346cd9e00b196c5687f9c9eb84d53e0f96310b85a926ce7c7dde254610a0163c0a08c3112877a5304cf63865908d2a0

  • SSDEEP

    98304:b6nQL/HqOgoxATqdi65sn6Wfz7pn3SB3AtZC0VZHtK9L6btqLH0hndfRNek5DFB:b2QL/KVhWPDOCBwtZVZILaM0RRRAyDj

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • UPX packed file 50 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b.exe
    "C:\Users\Admin\AppData\Local\Temp\797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Users\Admin\AppData\Local\Temp\797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b.exe
      "C:\Users\Admin\AppData\Local\Temp\797a91ceb89b57e6a5efa4b234bf071b4afb07745e546d0ab7635f9c0de5dc4b.exe"
      2⤵
      • Loads dropped DLL
      PID:4456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\VCRUNTIME140.dll

    Filesize

    96KB

    MD5

    f12681a472b9dd04a812e16096514974

    SHA1

    6fd102eb3e0b0e6eef08118d71f28702d1a9067c

    SHA256

    d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

    SHA512

    7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\VCRUNTIME140.dll

    Filesize

    96KB

    MD5

    f12681a472b9dd04a812e16096514974

    SHA1

    6fd102eb3e0b0e6eef08118d71f28702d1a9067c

    SHA256

    d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

    SHA512

    7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_bz2.pyd

    Filesize

    46KB

    MD5

    f5f4d231a7c611f417d4541c1aae4c10

    SHA1

    f0c7b2073568bd1b4d4a68c68e397d1c4c0de5d4

    SHA256

    fe3ececf82cdd471e61ac61923b7ecf9cf4df8f3a1116e8cf3a282d8d065df3a

    SHA512

    a31075c212f26f8be0598aecf44f936cf507f229c500f823951cd902fe03c2dc8cf66295a823c463299bae6a52117feb45dda1983ab0867df148daf327403fec

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_bz2.pyd

    Filesize

    46KB

    MD5

    f5f4d231a7c611f417d4541c1aae4c10

    SHA1

    f0c7b2073568bd1b4d4a68c68e397d1c4c0de5d4

    SHA256

    fe3ececf82cdd471e61ac61923b7ecf9cf4df8f3a1116e8cf3a282d8d065df3a

    SHA512

    a31075c212f26f8be0598aecf44f936cf507f229c500f823951cd902fe03c2dc8cf66295a823c463299bae6a52117feb45dda1983ab0867df148daf327403fec

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_ctypes.pyd

    Filesize

    56KB

    MD5

    b8887b1c0030c9b63028d493dde34d74

    SHA1

    b03c6444c1842dadccfd9b4054d34929dbccdf04

    SHA256

    47b601a4354fde1024b732d220631f09fda9c1820a2a65c15c02a0b066deb278

    SHA512

    846fb6319085e53d3c768c82248b65e516818e8c3e0e697e0bf77f589d4125d8387617e4e88e83e871ab4a483293036954df8c33539f7dba7ff35451eb3e9c72

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_ctypes.pyd

    Filesize

    56KB

    MD5

    b8887b1c0030c9b63028d493dde34d74

    SHA1

    b03c6444c1842dadccfd9b4054d34929dbccdf04

    SHA256

    47b601a4354fde1024b732d220631f09fda9c1820a2a65c15c02a0b066deb278

    SHA512

    846fb6319085e53d3c768c82248b65e516818e8c3e0e697e0bf77f589d4125d8387617e4e88e83e871ab4a483293036954df8c33539f7dba7ff35451eb3e9c72

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_hashlib.pyd

    Filesize

    33KB

    MD5

    ed2f19b39c926534a3f66804a72b0d53

    SHA1

    fca2296347f7dcd436a286f1e908988b0c43d2d5

    SHA256

    ebb44a13a343af88883fe3048437c7c6934f22126129086f6e386eaf59b746b8

    SHA512

    a3b5e39227f912b199b6332484a64dc83745768362a1e8c790396c50dae8fc51350263e7f4349595ed774f48f9e3e3cf57cef4de91348f1701d4fcd0a01ccee6

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_hashlib.pyd

    Filesize

    33KB

    MD5

    ed2f19b39c926534a3f66804a72b0d53

    SHA1

    fca2296347f7dcd436a286f1e908988b0c43d2d5

    SHA256

    ebb44a13a343af88883fe3048437c7c6934f22126129086f6e386eaf59b746b8

    SHA512

    a3b5e39227f912b199b6332484a64dc83745768362a1e8c790396c50dae8fc51350263e7f4349595ed774f48f9e3e3cf57cef4de91348f1701d4fcd0a01ccee6

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_lzma.pyd

    Filesize

    84KB

    MD5

    5aec5d1bd3108bf7cd556ac901389b8c

    SHA1

    7e09948cabbb4b4af1bf1c72d8c7aa3afc23183e

    SHA256

    b3522206bf15f7fb7f649c8e1e8edbb1a0b58bce997d4f88d0878ca77c85d12e

    SHA512

    4a8c47f17d2799080e9acc1c99ca8706b8cc29ab6e91ee7d9c7a0b5ff0f191311ba4a5963a7f4b5ef0038076ad5830e4347b475dbccab3939f8a6e0c1cd8e4be

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_lzma.pyd

    Filesize

    84KB

    MD5

    5aec5d1bd3108bf7cd556ac901389b8c

    SHA1

    7e09948cabbb4b4af1bf1c72d8c7aa3afc23183e

    SHA256

    b3522206bf15f7fb7f649c8e1e8edbb1a0b58bce997d4f88d0878ca77c85d12e

    SHA512

    4a8c47f17d2799080e9acc1c99ca8706b8cc29ab6e91ee7d9c7a0b5ff0f191311ba4a5963a7f4b5ef0038076ad5830e4347b475dbccab3939f8a6e0c1cd8e4be

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_socket.pyd

    Filesize

    41KB

    MD5

    83fa71bcfcdd78e9b21e4c002af9db47

    SHA1

    7bb246c21fac4d125942c0b017763595e475936b

    SHA256

    7d16e42e65c99fe3ae755045c1e4abd049bfd7e6f4ee7f366b776b365d82f2a2

    SHA512

    f02209e669cd0fe72cd2d8060f34a1ad559413179acab80769db026203b614b8b3415612831f89c11bd86bd00dbd91f8b04fd6d4f276311f09ba0877e6bc81cd

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_socket.pyd

    Filesize

    41KB

    MD5

    83fa71bcfcdd78e9b21e4c002af9db47

    SHA1

    7bb246c21fac4d125942c0b017763595e475936b

    SHA256

    7d16e42e65c99fe3ae755045c1e4abd049bfd7e6f4ee7f366b776b365d82f2a2

    SHA512

    f02209e669cd0fe72cd2d8060f34a1ad559413179acab80769db026203b614b8b3415612831f89c11bd86bd00dbd91f8b04fd6d4f276311f09ba0877e6bc81cd

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_ssl.pyd

    Filesize

    60KB

    MD5

    91bcf19bbbfdc276520072f276eef11e

    SHA1

    3627bffb0cfa326609b16cb0d4effc5fcdf06025

    SHA256

    b89b461de18660dd2ab94ab271833894c8a518252b2002096ef8eea8ee07168d

    SHA512

    06498e9ca0169e02d65823498b5bd7478a630c3fde23acf11fee94947d703c72b2ce1531b5c46cdaa95b93c66b9c314113dd348f8c37eda84510a4078a27a2b1

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\_ssl.pyd

    Filesize

    60KB

    MD5

    91bcf19bbbfdc276520072f276eef11e

    SHA1

    3627bffb0cfa326609b16cb0d4effc5fcdf06025

    SHA256

    b89b461de18660dd2ab94ab271833894c8a518252b2002096ef8eea8ee07168d

    SHA512

    06498e9ca0169e02d65823498b5bd7478a630c3fde23acf11fee94947d703c72b2ce1531b5c46cdaa95b93c66b9c314113dd348f8c37eda84510a4078a27a2b1

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\base_library.zip

    Filesize

    1.0MB

    MD5

    7c532a132dfcecdc2123efc801658bfa

    SHA1

    36d5172bc44cc7c0ca75cfc4beca5eee401879c0

    SHA256

    c42956b86a363495dd18d95af57765539de4786cdc53055939a797083917ef3e

    SHA512

    778bc30dc4a82ae7582aa1bef11e6e57b261495506b198dea4113932f4640cb62f19b9e40c82798a9c2673f04f9b74409ca192990c6e829dbbb7c623ab1c3659

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libcrypto-1_1.dll

    Filesize

    1.1MB

    MD5

    205412dc7f3cd894644a96e97e1a3cb8

    SHA1

    e80a8254a3a4d7db7d3db5b18640db34c0648d3e

    SHA256

    adebe92032896cc3eab9d28563b129ad6910ee368dcb98997c742b4054716be9

    SHA512

    22535daaa0704e3158d03f6f2890c4f6a08c3d6ca4593d9bdf4fc437b06cb03fc383d18cf9b99a230c29d36929e69bda89c558e2c09ff3ea6bfbf4b4cdad65c2

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libcrypto-1_1.dll

    Filesize

    1.1MB

    MD5

    205412dc7f3cd894644a96e97e1a3cb8

    SHA1

    e80a8254a3a4d7db7d3db5b18640db34c0648d3e

    SHA256

    adebe92032896cc3eab9d28563b129ad6910ee368dcb98997c742b4054716be9

    SHA512

    22535daaa0704e3158d03f6f2890c4f6a08c3d6ca4593d9bdf4fc437b06cb03fc383d18cf9b99a230c29d36929e69bda89c558e2c09ff3ea6bfbf4b4cdad65c2

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libffi-7.dll

    Filesize

    23KB

    MD5

    ce7d4f152de90a24b0069e3c95fa2b58

    SHA1

    98e921d9dd396b86ae785d9f8d66f1dc612111c2

    SHA256

    85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

    SHA512

    7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libffi-7.dll

    Filesize

    23KB

    MD5

    ce7d4f152de90a24b0069e3c95fa2b58

    SHA1

    98e921d9dd396b86ae785d9f8d66f1dc612111c2

    SHA256

    85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

    SHA512

    7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libssl-1_1.dll

    Filesize

    200KB

    MD5

    d879b60a4500e5a7d1779d20e43a8edc

    SHA1

    730a6625745639073565d66530335aae30934cbf

    SHA256

    7245ff47c2e6e39d06935060fb045c688eb8c170bfdeb0174954c0c65055923c

    SHA512

    fa0f0b4d42b16fbb44f0c2c0c9ad60985be796b8838217a9d756e918e17c73ffefff9353f6fa4f9ba7066a5019a888a3d2399c10b21a4079df1667e1c6df2073

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\libssl-1_1.dll

    Filesize

    200KB

    MD5

    d879b60a4500e5a7d1779d20e43a8edc

    SHA1

    730a6625745639073565d66530335aae30934cbf

    SHA256

    7245ff47c2e6e39d06935060fb045c688eb8c170bfdeb0174954c0c65055923c

    SHA512

    fa0f0b4d42b16fbb44f0c2c0c9ad60985be796b8838217a9d756e918e17c73ffefff9353f6fa4f9ba7066a5019a888a3d2399c10b21a4079df1667e1c6df2073

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\python310.dll

    Filesize

    1.4MB

    MD5

    dccf77f6ab7c6600e8b46280020b7902

    SHA1

    fd50cdf5dcfa34146fb82820fcc680c26b7aa64f

    SHA256

    f33ed93ae4b6011c8be2802304a759a5d2de8fd14c5dc34d0232aa4f8389766b

    SHA512

    42656f0f7e62454a763aa665cd31025a6bc4fb3802da4d4e3e151e2ffde3a651afce2d5e56b16c3e8215057c260248e683968d57940ff789f97ffb2d840b9a6d

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\python310.dll

    Filesize

    1.4MB

    MD5

    dccf77f6ab7c6600e8b46280020b7902

    SHA1

    fd50cdf5dcfa34146fb82820fcc680c26b7aa64f

    SHA256

    f33ed93ae4b6011c8be2802304a759a5d2de8fd14c5dc34d0232aa4f8389766b

    SHA512

    42656f0f7e62454a763aa665cd31025a6bc4fb3802da4d4e3e151e2ffde3a651afce2d5e56b16c3e8215057c260248e683968d57940ff789f97ffb2d840b9a6d

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\select.pyd

    Filesize

    24KB

    MD5

    e29fac3a4f749e4d49cca9c443a67997

    SHA1

    dcb985390615076e0a7e58dd494c2944c2164fbc

    SHA256

    6b4527434453393834c7e2701321a913d93ad747b3eebb8c3788d9a92576e00e

    SHA512

    b53d500e95ed5d62c597f6af2940854eae67f28d49d0c9b1ab7c978ff66dd25fd30c3c20bd59d716ad546bdc66309bff50663874cf39eec9bbb70c82f6037dd8

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\select.pyd

    Filesize

    24KB

    MD5

    e29fac3a4f749e4d49cca9c443a67997

    SHA1

    dcb985390615076e0a7e58dd494c2944c2164fbc

    SHA256

    6b4527434453393834c7e2701321a913d93ad747b3eebb8c3788d9a92576e00e

    SHA512

    b53d500e95ed5d62c597f6af2940854eae67f28d49d0c9b1ab7c978ff66dd25fd30c3c20bd59d716ad546bdc66309bff50663874cf39eec9bbb70c82f6037dd8

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\ucrtbase.dll

    Filesize

    1020KB

    MD5

    2c8fe06966d5085a595ffa3c98fe3098

    SHA1

    e82945e3e63ffef0974d6dd74f2aef2bf6d0a908

    SHA256

    de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65

    SHA512

    fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\ucrtbase.dll

    Filesize

    1020KB

    MD5

    2c8fe06966d5085a595ffa3c98fe3098

    SHA1

    e82945e3e63ffef0974d6dd74f2aef2bf6d0a908

    SHA256

    de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65

    SHA512

    fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\unicodedata.pyd

    Filesize

    288KB

    MD5

    3f17464857c1d6fc317dd37ac60f33e3

    SHA1

    565fa2cf2fab407fe3fbfa4c49af43efada051a5

    SHA256

    60f811169ca85973b5253d3c5eebad20fd0b1285d7a9f1f309242cf7f2f37e24

    SHA512

    7fad688708762c974e043731fc92da2c0ee1e2b1f44c41cce65beae63d13c97f1216d389b14836217cab6701d550aae21c88b94a34a1c3ab3af4f601178fe1a9

  • C:\Users\Admin\AppData\Local\Temp\_MEI15402\unicodedata.pyd

    Filesize

    288KB

    MD5

    3f17464857c1d6fc317dd37ac60f33e3

    SHA1

    565fa2cf2fab407fe3fbfa4c49af43efada051a5

    SHA256

    60f811169ca85973b5253d3c5eebad20fd0b1285d7a9f1f309242cf7f2f37e24

    SHA512

    7fad688708762c974e043731fc92da2c0ee1e2b1f44c41cce65beae63d13c97f1216d389b14836217cab6701d550aae21c88b94a34a1c3ab3af4f601178fe1a9

  • memory/4456-201-0x00007FFDCC680000-0x00007FFDCCAEE000-memory.dmp

    Filesize

    4.4MB

  • memory/4456-203-0x00007FFDDDE30000-0x00007FFDDDE3F000-memory.dmp

    Filesize

    60KB

  • memory/4456-204-0x00007FFDDCF60000-0x00007FFDDCF74000-memory.dmp

    Filesize

    80KB

  • memory/4456-202-0x00007FFDCDB60000-0x00007FFDCDB84000-memory.dmp

    Filesize

    144KB

  • memory/4456-220-0x00007FFDCC240000-0x00007FFDCC5B7000-memory.dmp

    Filesize

    3.5MB

  • memory/4456-221-0x00007FFDDCB90000-0x00007FFDDCBA9000-memory.dmp

    Filesize

    100KB

  • memory/4456-222-0x00007FFDDDD90000-0x00007FFDDDD9D000-memory.dmp

    Filesize

    52KB

  • memory/4456-223-0x00007FFDCDB30000-0x00007FFDCDB5E000-memory.dmp

    Filesize

    184KB

  • memory/4456-224-0x00007FFDCC180000-0x00007FFDCC237000-memory.dmp

    Filesize

    732KB

  • memory/4456-226-0x00007FFDCDB00000-0x00007FFDCDB2D000-memory.dmp

    Filesize

    180KB

  • memory/4456-225-0x00007FFDDC890000-0x00007FFDDC8A9000-memory.dmp

    Filesize

    100KB

  • memory/4456-227-0x00007FFDCBEA0000-0x00007FFDCBFB8000-memory.dmp

    Filesize

    1.1MB

  • memory/4456-228-0x00007FFDCC680000-0x00007FFDCCAEE000-memory.dmp

    Filesize

    4.4MB

  • memory/4456-231-0x00007FFDDCF60000-0x00007FFDDCF74000-memory.dmp

    Filesize

    80KB

  • memory/4456-252-0x00007FFDCC680000-0x00007FFDCCAEE000-memory.dmp

    Filesize

    4.4MB

  • memory/4456-254-0x00007FFDDDE30000-0x00007FFDDDE3F000-memory.dmp

    Filesize

    60KB

  • memory/4456-253-0x00007FFDCDB60000-0x00007FFDCDB84000-memory.dmp

    Filesize

    144KB

  • memory/4456-255-0x00007FFDDCF60000-0x00007FFDDCF74000-memory.dmp

    Filesize

    80KB

  • memory/4456-256-0x00007FFDCC240000-0x00007FFDCC5B7000-memory.dmp

    Filesize

    3.5MB

  • memory/4456-260-0x00007FFDCC180000-0x00007FFDCC237000-memory.dmp

    Filesize

    732KB

  • memory/4456-258-0x00007FFDDDD90000-0x00007FFDDDD9D000-memory.dmp

    Filesize

    52KB

  • memory/4456-262-0x00007FFDCDB00000-0x00007FFDCDB2D000-memory.dmp

    Filesize

    180KB

  • memory/4456-263-0x00007FFDCBEA0000-0x00007FFDCBFB8000-memory.dmp

    Filesize

    1.1MB

  • memory/4456-261-0x00007FFDDC890000-0x00007FFDDC8A9000-memory.dmp

    Filesize

    100KB

  • memory/4456-259-0x00007FFDCDB30000-0x00007FFDCDB5E000-memory.dmp

    Filesize

    184KB

  • memory/4456-257-0x00007FFDDCB90000-0x00007FFDDCBA9000-memory.dmp

    Filesize

    100KB