57316e29bbf6391f28d0c11c78b61607b9b1a4e87fb3adbb1855b8773223f0e1

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2023 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

logsave.exe
Size

6.1MB
MD5

1c1d273d8769694becc49e11115b836b
SHA1

fa922c02249d42f52b5567ebbfd80f075229f01b
SHA256

6f308020a1f664d2ed8682948782a69deba034ce5b1e51c7bc5234919c5816b3
SHA512

1f11c4e2671cdb61a4467127a492299dbfb47d53fad7db9f94767e152c82c4395ad0352d9b5534d7574702c0076027f97ae71637a94cc5b27d7056a9f6f27516
SSDEEP

196608:n29j89onJ5hrZEce9tGPqKSWaTbIAa8XH:2F89c5hlEiPNSWa3VX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

logsave.exe

pid process

372 logsave.exe
372 logsave.exe
372 logsave.exe
372 logsave.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

logsave.exe

description pid process

Token: 35 372 logsave.exe
Token: SeDebugPrivilege 372 logsave.exe

pid	process
372	logsave.exe
372	logsave.exe
372	logsave.exe
372	logsave.exe

description	pid	process
Token: 35	372	logsave.exe
Token: SeDebugPrivilege	372	logsave.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

logsave.exe

description	pid	process	target process
PID 2428 wrote to memory of 372	2428	logsave.exe	logsave.exe
PID 2428 wrote to memory of 372	2428	logsave.exe	logsave.exe

C:\Users\Admin\AppData\Local\Temp\logsave.exe
"C:\Users\Admin\AppData\Local\Temp\logsave.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Local\Temp\logsave.exe
"C:\Users\Admin\AppData\Local\Temp\logsave.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24282\VCRUNTIME140.dll
Filesize
85KB

MD5
89a24c66e7a522f1e0016b1d0b4316dc

SHA1
5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

SHA256
3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

SHA512
e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\VCRUNTIME140.dll
Filesize
85KB

MD5
89a24c66e7a522f1e0016b1d0b4316dc

SHA1
5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

SHA256
3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

SHA512
e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\_ctypes.pyd
Filesize
129KB

MD5
5e869eebb6169ce66225eb6725d5be4a

SHA1
747887da0d7ab152e1d54608c430e78192d5a788

SHA256
430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

SHA512
feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\_ctypes.pyd
Filesize
129KB

MD5
5e869eebb6169ce66225eb6725d5be4a

SHA1
747887da0d7ab152e1d54608c430e78192d5a788

SHA256
430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

SHA512
feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\base_library.zip
Filesize
1000KB

MD5
90c0898cd529e19ba0c800d0e1f42a2a

SHA1
35882c9e2519be24ad4625031c942722946e791e

SHA256
980eab75d2e03b71fa4327da3a3126ad6980ff60a5cf9ad2b96ce06ad15ae3bd

SHA512
3527929f185b4a044d925c8cca0fc028d470c48756623762722bce483f9b9541d073bee69529c5b4c7b0b9e3b81307fa3afd0a7a4d9df60f93c66b85af6cce46

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\python37.dll
Filesize
3.6MB

MD5
c4709f84e6cf6e082b80c80b87abe551

SHA1
c0c55b229722f7f2010d34e26857df640182f796

SHA256
ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

SHA512
e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\python37.dll
Filesize
3.6MB

MD5
c4709f84e6cf6e082b80c80b87abe551

SHA1
c0c55b229722f7f2010d34e26857df640182f796

SHA256
ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

SHA512
e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\ucrtbase.dll
Filesize
1011KB

MD5
849959a003fa63c5a42ae87929fcd18b

SHA1
d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

SHA256
6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

SHA512
64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24282\ucrtbase.dll
Filesize
1011KB

MD5
849959a003fa63c5a42ae87929fcd18b

SHA1
d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

SHA256
6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

SHA512
64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

Download Submit
memory/372-83-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-95-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-65-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-67-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-69-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-71-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-73-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-75-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-77-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-79-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-81-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-61-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-85-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-87-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-89-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-91-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-93-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-63-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-99-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-97-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-101-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-103-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-105-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-107-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-109-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-111-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-113-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-115-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-117-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-119-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-121-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-123-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download
memory/372-482-0x000001D004A40000-0x000001D004A92000-memory.dmp

Filesize
328KB

Download