3f28b48e6ba9749318bd1ee83381fe976053ce53183a67525d5bac7fee8d1c03

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2023, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

myshell.exe
Size

6.2MB
MD5

2bd96994657b57b309e52dae445e3d76
SHA1

31a732f893b5022313dc405e40d53cbed19d3a7b
SHA256

3f28b48e6ba9749318bd1ee83381fe976053ce53183a67525d5bac7fee8d1c03
SHA512

6f756ed8259fb80767ddce8843364bb7411279bd785c82db1a605eb13e98429a5d46a9a0634e6681ca699fc1ef4cbd19f6bef4da7cfe172837bdc9e614c0ec80
SSDEEP

196608:9OIm9onJ5hrZEjyiU8AdZYJERurTgpf5q2YPG:9m9c5hlEbAdZYygrK5q2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 12 IoCs

pid	Process
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe
1448	myshell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1372	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	whoami.exe
Token: SeDebugPrivilege	2768	whoami.exe
Token: SeDebugPrivilege	3816	whoami.exe
Token: SeDebugPrivilege	3612	whoami.exe
Token: SeDebugPrivilege	1100	whoami.exe
Token: SeDebugPrivilege	3520	whoami.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1448	4980	myshell.exe	85
PID 4980 wrote to memory of 1448	4980	myshell.exe	85
PID 1448 wrote to memory of 1228	1448	myshell.exe	100
PID 1448 wrote to memory of 1228	1448	myshell.exe	100
PID 1448 wrote to memory of 956	1448	myshell.exe	97
PID 1448 wrote to memory of 956	1448	myshell.exe	97
PID 1228 wrote to memory of 4856	1228	cmd.exe	102
PID 1228 wrote to memory of 4856	1228	cmd.exe	102
PID 956 wrote to memory of 2768	956	cmd.exe	101
PID 956 wrote to memory of 2768	956	cmd.exe	101
PID 1448 wrote to memory of 2240	1448	myshell.exe	103
PID 1448 wrote to memory of 2240	1448	myshell.exe	103
PID 1448 wrote to memory of 1996	1448	myshell.exe	105
PID 1448 wrote to memory of 1996	1448	myshell.exe	105
PID 2240 wrote to memory of 3816	2240	cmd.exe	107
PID 2240 wrote to memory of 3816	2240	cmd.exe	107
PID 1996 wrote to memory of 3612	1996	cmd.exe	108
PID 1996 wrote to memory of 3612	1996	cmd.exe	108
PID 1448 wrote to memory of 4368	1448	myshell.exe	109
PID 1448 wrote to memory of 4368	1448	myshell.exe	109
PID 4368 wrote to memory of 1100	4368	cmd.exe	111
PID 4368 wrote to memory of 1100	4368	cmd.exe	111
PID 1448 wrote to memory of 3864	1448	myshell.exe	113
PID 1448 wrote to memory of 3864	1448	myshell.exe	113
PID 3864 wrote to memory of 3520	3864	cmd.exe	115
PID 3864 wrote to memory of 3520	3864	cmd.exe	115
PID 1448 wrote to memory of 2844	1448	myshell.exe	116
PID 1448 wrote to memory of 2844	1448	myshell.exe	116
PID 1448 wrote to memory of 5020	1448	myshell.exe	118
PID 1448 wrote to memory of 5020	1448	myshell.exe	118
PID 5020 wrote to memory of 1372	5020	cmd.exe	120
PID 5020 wrote to memory of 1372	5020	cmd.exe	120
PID 1448 wrote to memory of 3016	1448	myshell.exe	121
PID 1448 wrote to memory of 3016	1448	myshell.exe	121
PID 1448 wrote to memory of 388	1448	myshell.exe	124
PID 1448 wrote to memory of 388	1448	myshell.exe	124

C:\Users\Admin\AppData\Local\Temp\myshell.exe
"C:\Users\Admin\AppData\Local\Temp\myshell.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\myshell.exe
  "C:\Users\Admin\AppData\Local\Temp\myshell.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "dir c:\users\admin"
    3⤵
    PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ipconfig"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "dir c:\users\admin\desktop"
    3⤵
    PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "dir c:\users\admin\downloads"
    3⤵
    PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_bz2.pyd

Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_bz2.pyd

Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_hashlib.pyd

Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_hashlib.pyd

Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_lzma.pyd

Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_lzma.pyd

Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_queue.pyd

Filesize
27KB

MD5
4ab2ceb88276eba7e41628387eacb41e

SHA1
58f7963ba11e1d3942414ef6dab3300a33c8a2bd

SHA256
d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839

SHA512
b0d131e356ce35e603acf0168e540c89f600ba2ab2099ccf212e0b295c609702ac4a7b0a7dbc79f46eda50e7ea2cf09917832345dd8562d916d118aba2fa3888

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_queue.pyd

Filesize
27KB

MD5
4ab2ceb88276eba7e41628387eacb41e

SHA1
58f7963ba11e1d3942414ef6dab3300a33c8a2bd

SHA256
d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839

SHA512
b0d131e356ce35e603acf0168e540c89f600ba2ab2099ccf212e0b295c609702ac4a7b0a7dbc79f46eda50e7ea2cf09917832345dd8562d916d118aba2fa3888

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_socket.pyd

Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_socket.pyd

Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_ssl.pyd

Filesize
149KB

MD5
ef4755195cc9b2ff134ea61acde20637

SHA1
d5ba42c97488da1910cf3f83a52f7971385642c2

SHA256
8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

SHA512
63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\_ssl.pyd

Filesize
149KB

MD5
ef4755195cc9b2ff134ea61acde20637

SHA1
d5ba42c97488da1910cf3f83a52f7971385642c2

SHA256
8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

SHA512
63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\base_library.zip

Filesize
1006KB

MD5
7e25fffc0cc225844c47b588556a5779

SHA1
dd8c6b3b1ea46dfdad2cd2f4729339be3ebdd9c1

SHA256
b327f4a729f38e5e38ad9ef64d726303baaf6cada346acc1f605ed5fcabd7356

SHA512
6d36d0b691190e4b8254861329d9bfc2aede6b7cd97b82d9618ccce71dc9cc7014f741353e0d3df6caf51b2f586cfd0f08351549e4fbce5797a013ce0fcf7456

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\certifi\cacert.pem

Filesize
279KB

MD5
7adbcc03e8c4f261c08db67930ec6fdd

SHA1
edc6158964acc5999ed5413575dd9a650a6bcdb2

SHA256
de5f02716b7fa8be36d37d2b1a2783dd22ee7c80855f46d8b4684397f11754f2

SHA512
58299ed51d66a801e2927d13c4304b7020eac80982559c7b898c46909d0bc902eb13fea501bd600c8c19739736289342bae227510c85702b7f04bd80d5a9c723

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\select.pyd

Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\select.pyd

Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\unicodedata.pyd

Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49802\unicodedata.pyd

Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit