883ef3b2aef3a255ef8610a1cf6810397fb7d35a5b3e5585cb3f283b062ce616

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3dd38f9bf213dea97f89e287d59fe3b.exe
Size 9.4MB
Sample230707-pk183sha79
SHA256 883ef3b2aef3a255ef8610a1cf6810397fb7d35a5b3e5585cb3f283b062ce616
MD5 d3dd38f9bf213dea97f89e287d59fe3b
SHA1 90475eecbcbb9d6e422b249d4174ff73ef8741d5
SHA512 2f044c5122f050d5bd91eea6fa219e5613fd3b9f53efd62380bce3e5373eefea46d644825b103caeef0d3416ed57e28504fb9c890dcba4d96e23cf4b8b583b7a
SSDEEP 98304:+kLhd4EfX3ZOKRtlrJ7BfGrs1BHeM+2PrcL2Xl3+bsTTa75:ZhffX3ZOKRtlt7Bfl+OcL2YsTC5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp
4472	pythonw.exe

Loads dropped DLL 2 IoCs

pid	Process
4472	pythonw.exe
4472	pythonw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4472 set thread context of 4668	4472	pythonw.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp
4472	pythonw.exe
4668	ftp.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4472	pythonw.exe
4668	ftp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5072	2432	d3dd38f9bf213dea97f89e287d59fe3b.exe	84
PID 2432 wrote to memory of 5072	2432	d3dd38f9bf213dea97f89e287d59fe3b.exe	84
PID 2432 wrote to memory of 5072	2432	d3dd38f9bf213dea97f89e287d59fe3b.exe	84
PID 5072 wrote to memory of 4472	5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp	85
PID 5072 wrote to memory of 4472	5072	d3dd38f9bf213dea97f89e287d59fe3b.tmp	85
PID 4472 wrote to memory of 4668	4472	pythonw.exe	86
PID 4472 wrote to memory of 4668	4472	pythonw.exe	86
PID 4472 wrote to memory of 4668	4472	pythonw.exe	86
PID 4472 wrote to memory of 4668	4472	pythonw.exe	86
PID 4668 wrote to memory of 900	4668	ftp.exe	89
PID 4668 wrote to memory of 900	4668	ftp.exe	89
PID 4668 wrote to memory of 900	4668	ftp.exe	89
PID 4668 wrote to memory of 900	4668	ftp.exe	89
PID 4668 wrote to memory of 900	4668	ftp.exe	89

C:\Users\Admin\AppData\Local\Temp\d3dd38f9bf213dea97f89e287d59fe3b.exe
"C:\Users\Admin\AppData\Local\Temp\d3dd38f9bf213dea97f89e287d59fe3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\is-HAS6L.tmp\d3dd38f9bf213dea97f89e287d59fe3b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HAS6L.tmp\d3dd38f9bf213dea97f89e287d59fe3b.tmp" /SL5="$60100,8983401,832512,C:\Users\Admin\AppData\Local\Temp\d3dd38f9bf213dea97f89e287d59fe3b.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\pythonw.exe
    "C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\pythonw.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /FORCECLOSEAPPLICATIONS /SP- /portable=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\SysWOW64\ftp.exe
      "C:\Windows\SysWOW64\ftp.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\werfault.exe
        
        "C:\Windows\SysWOW64\werfault.exe"
        5⤵
        
        PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1a024a9d

Path C:\Users\Admin\AppData\Local\Temp\1a024a9d
Size 750KB
SHA256 7ae03509c04e06a110b97cf03cbb675255aa9c67ad2a85d78b73dcd6447249a1
MD5 fc0b02b7e6ee36f30ee8285239bcb8ed
SHA1 245c232feaab5d07398d542af67c4664bf088516
SHA512 81d2b5f021bfe195bc56041dfbc944a5abc07f0bf0f07fa214cf2dbd5ba28b2672f7e083eda4a5eeee6d51517b0f2c18c3ccea28e1c40d1a5aac1c8a2bf53e0b
SSDEEP 12288:CQzcIgTvUcj6vcCFXW0l/0pnGJzlwqyCVf6DS5VB4GCRBppYowslhL1wHszdplYx:xc0RFgEHSBjYyLKHkNiRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\lang
Size 1.9MB
SHA256 ac9352f148dfbd067a852656bf75e1f9e0e11b2847842afc577d1c8c485c624d
MD5 bf37afb5e249da3665ca08afb33424ff
SHA1 22232569e7d6d8f7bdcd6a797022e3cd00deac9e
SHA512 f64630764592bb19efff3383d7266c75ee7ff8e367e8a3e842fa4f4f981d96624e8517d75fbed67ae0a4179545ee9fa4f8b97af88899fd757af28c8446262d04
SSDEEP 12288:yrUmfk6twVJ4fB4Sz7cAmfjS1ibfqdhp04o7+RsBAjDA9V2ahxYcNG7wCHt/54K:n8f7sFmsO47+RsBK09V2FcVKH4K
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\python311.dll
Size 5.5MB
SHA256 8e28a15e69eaed3df9455cc657d2e27889faa37cc23c36720eb7872f8eb3e772
MD5 fb28fbf7edcc4d5cf98769e4f813f24f
SHA1 4611b21268d8e777c9516bb18d47d5dedbb24bef
SHA512 f582b7c1c05e5aa147793c2563ec790dc4a44bc0545d5531b10f163021eea9bb984995fe00ec8c8b270d0c76c0e967a88cb89fee5eb29ae5cc73d7e11a4a315b
SSDEEP 49152:73djosVvASxQKADxYBVD0NErnKqroleDkcT/Q3pPI6bwVFZL7VgVr42I1vJHH+My:73ZOKRtlrJ7BfGrs1BHeM+2PrcL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\python311.dll
Size 5.5MB
SHA256 8e28a15e69eaed3df9455cc657d2e27889faa37cc23c36720eb7872f8eb3e772
MD5 fb28fbf7edcc4d5cf98769e4f813f24f
SHA1 4611b21268d8e777c9516bb18d47d5dedbb24bef
SHA512 f582b7c1c05e5aa147793c2563ec790dc4a44bc0545d5531b10f163021eea9bb984995fe00ec8c8b270d0c76c0e967a88cb89fee5eb29ae5cc73d7e11a4a315b
SSDEEP 49152:73djosVvASxQKADxYBVD0NErnKqroleDkcT/Q3pPI6bwVFZL7VgVr42I1vJHH+My:73ZOKRtlrJ7BfGrs1BHeM+2PrcL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\pythonw.exe
Size 99KB
SHA256 695ec4080f596f485e4e36de383a32f18042bc13620cf93ba5708ec354b6ca0d
MD5 9d0f19a3fdf077fc90cb1055018669fd
SHA1 0a5ade59ac8a697f6ea7f437be85e2d378597d5d
SHA512 ad4eb8f3a99122aff390b32de6394b604144c6bf5caa393cfe3b02c8c5df9508d346fb88e0d2c72591a05b5340937ee85f6b244583db9d19deecb2115de6d69e
SSDEEP 1536:UqIuhIxHHWMpdPa5wiE21M8kJIGFvb1CwP/i5ss7SyHPx:UqXSwMpdCq/IM8uIGfl/i5ssJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\is-2BAL4.tmp+!@\ShellExtension_1.0.0.2_x64__7338jccfasrzy\Packages\vcruntime140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dd38f9bf213dea97f89e287d59fe3b.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HAS6L.tmp\d3dd38f9bf213dea97f89e287d59fe3b.tmp
Size 3.1MB
SHA256 9fbe68317af1bbe47ef68d3ceaa4007477922d8aaa72e54bf4ae72ef29313bc4
MD5 f728e3b07140cd94157ecc494ee52633
SHA1 fa1de956a33bf53742ea366a8d2f96707dad7c23
SHA512 b658a9a82c9b833e3675de79b2f1580474a0f917c1a42ee1be6548977b12b2d87eae13fa6696078546944dea05fa1111651a56096ed0701c1b58b8935b78a27d
SSDEEP 49152:WWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:atLutqgwh4NYxtJpkxhGj333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2432-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2432-169-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4668-173-0x00007FFA28C90000-0x00007FFA28E85000-memory.dmp

Download

memory/5072-167-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/5072-138-0x0000000000850000-0x0000000000851000-memory.dmp

Download