Analysis

  • max time kernel
    160s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 12:44

General

  • Target

    8c3d24444b55e491253d0c584acf1cf0.exe

  • Size

    7.6MB

  • MD5

    8c3d24444b55e491253d0c584acf1cf0

  • SHA1

    0c274f62618a9157f32156bf35f736a1e9767c46

  • SHA256

    60119b9585f651bf504c1c0215ee1067c6247f20fabf590aedce27138d4627fe

  • SHA512

    aa249c156775edcdc672dd79a9c0200c1c3006accb0d745291af3029e7a4988409a2c1ebe8b6d11ea05bb742e53cb790474ae128ac701d48efb100c68dc8e47d

  • SSDEEP

    196608:/hzkpaoCsXDjDyf0wKP5W3I6sKpDfyOA6yHjmYL+H9uCxic:hiDCEDWKRW3I1KpD8n/iICx

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 24 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c3d24444b55e491253d0c584acf1cf0.exe
    "C:\Users\Admin\AppData\Local\Temp\8c3d24444b55e491253d0c584acf1cf0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Users\Admin\AppData\Local\Temp\8c3d24444b55e491253d0c584acf1cf0.exe
      "C:\Users\Admin\AppData\Local\Temp\8c3d24444b55e491253d0c584acf1cf0.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:3696

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\VCRUNTIME140.dll

            Filesize

            93KB

            MD5

            ade7aac069131f54e4294f722c17a412

            SHA1

            fede04724bdd280dae2c3ce04db0fe5f6e54988d

            SHA256

            92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76

            SHA512

            76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_asyncio.pyd

            Filesize

            63KB

            MD5

            ddec3abd77e1aa7a5cbe83d1d75640c8

            SHA1

            5087cfae4079b1a29f1fc89919c5ebcb6715fa70

            SHA256

            3b046f8af9be391823a8c962e3fd2145a0d31ac46f39caafb799ac931c5f0e70

            SHA512

            63ec80fdfdc53419a94e83553926294a5bce9ad0c04d33156135bbd1b41d284a0aa02935eaa3fcd5dfb50bcf34b2b4c534803c5bf6d2c87af69987aec9c3564f

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_bz2.pyd

            Filesize

            85KB

            MD5

            0083b7118baca26c44df117a40b8e974

            SHA1

            218176d616a57fd2057a34c98f510ac8b7d0f550

            SHA256

            e1f791a3f5e277880d56f21006cec8e0b93ca50cd4464b2b4c6e88ab3ca5234d

            SHA512

            e093937e4f1c8e3c321e2059a3dda703f0d3df88deba2b15656bca87a258a9cd4dc677859cb1879157d4e60e10efb4d35c402135960ef2afddfef9c388077b85

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_bz2.pyd

            Filesize

            46KB

            MD5

            93aafe7e52a66a953f8c23e49cce2801

            SHA1

            b091e8c038321523c54b221ee48fad33925cc600

            SHA256

            2f37042fd5157bce12532160fb51b86457839c5164e3df7dd34fab2f52cc0df7

            SHA512

            b2e2d769953a04259b15289d94abfc39ba1a4f2427dc661d0ad9ee124b5b63097e41c31a0043fd9a17fd597556b85326f9a63250881e32d3cee45ed4db772e13

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_ctypes.pyd

            Filesize

            123KB

            MD5

            9755d3747e407ca70a4855bc9e98cfb9

            SHA1

            5a1871716715ba7f898afaae8c182bd8199ed60a

            SHA256

            213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2

            SHA512

            fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_hashlib.pyd

            Filesize

            46KB

            MD5

            f6f10f79867e33929e8c3263beaee423

            SHA1

            91ed04e12da5e5bed607f1957ede5057d78c275f

            SHA256

            c66d0a524a9d6c7f110273ffb14fb0ead440bf42f7a3957554f8b053331a7c3c

            SHA512

            30004621f7ee267e18987922b3e4243da6080cc7fcff8caa9cc8fdf795ba156ffba8c163a621959c2696cea6835398b046ff3175c0d02154532a93395391124b

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_lzma.pyd

            Filesize

            68KB

            MD5

            375f8689960a61cf2f73727cced74fff

            SHA1

            31ce842d4c61a86db8d3c9ffec1cf6bac5e17605

            SHA256

            1b9e9f370dee3f20e1af56c797e3ab3d11dd949b68d4742e2f41cee71b2f1436

            SHA512

            c203073b460fbf9d152c77e9882043e7abfb627ae6736fb60bf4ae3f8b5532ad88f22d3d94f058c30ee0439f0b5711669c3bf61db85d4ab94146367b803f30cd

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_lzma.pyd

            Filesize

            159KB

            MD5

            e63bf80e04ae950ef22d8fc100d6495f

            SHA1

            f2340ecaa46cb1737abcb19dbab6de9e3cbc51d7

            SHA256

            f4016a1a8eb34aaf4f20d6c2fdbb02992cc5125f5c32f0335c6dfbeedb9add5c

            SHA512

            cd70c7c99e5fb131567aa2213abd5f811e2a271ac12a2210be6a04728c696c407814e4535e7ca19ca86a2d3311d822cc6985864a2e178e1b36faf6bc828e621f

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_overlapped.pyd

            Filesize

            45KB

            MD5

            9f0c3fee89ac85b6579161290f75507b

            SHA1

            b823351886cf45f4af7ca11edface14386d1f017

            SHA256

            5cc0376cd4cd17f6816103d24804076fc67b9c4b9108424af163872d2de2b018

            SHA512

            7ce032483dd1a97e18cd7caa907ecf4794284bb2cfcbfdb56d8b4853387641df33cfe0d040cd339c7fc86a82e0dcb993ec19d5a2d5a24a102cbe70cafd01bc87

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_queue.pyd

            Filesize

            28KB

            MD5

            25e90e7317853c3807893591d72c1c11

            SHA1

            d6df3b4dd8c6235f263b637ec4646b56c9c977b2

            SHA256

            72584c4be4e56b0c26023a30385e90a1b5ac3a8d559007d90da11e5262ec7b76

            SHA512

            6130e9631465ec7b5bc65e29dd23ea99846baf34b55c69b86774e586c193eea2b4c0557f0d3980b317fece7eb1b9a2f612eb48697b5c61850baf16dbcc3f5a87

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_socket.pyd

            Filesize

            77KB

            MD5

            ee5c9250e766a02aa745a0d1493a387c

            SHA1

            0e6e86b7cda5f99e719dab8bdcae21558e7def10

            SHA256

            28b23ef979ff75b3cc44fce358b7ed087488105e3186249163504cd719567ccf

            SHA512

            ba4ad7d081b307f220212a9fbf982f925ac742eec64b3c9ed2bdbf3d06a589b1acc992d9585dec077de3b7f9e814a7115470a89307123491a3aff0ac3d795419

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\_ssl.pyd

            Filesize

            151KB

            MD5

            ce0ef7db1b5ec4211c901ef0ccc4c168

            SHA1

            da92022e89b5c6e4d7b0ce704cfba1ba0f50d20e

            SHA256

            bbcc8078d2624506bd33ed25a64230f9be74e7ff87faef517ab28e2f63f5e77a

            SHA512

            0c50bb2d47b0252419a1f7d58512cf2bdfc024b3f9dbbd44cd989d6e9e5d493631404b251afe0ce888ff61ed45c29c378b94801660d0429368df902f2eebb481

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_frozenlist.cp38-win_amd64.pyd

            Filesize

            62KB

            MD5

            fc8a220585322021416cfc4bce9a9697

            SHA1

            76c9ab2cc8ae23e091baf4ae52a5ff1d0668a683

            SHA256

            5440e7d58e44d2cca5764b6e282da61c63990b5ef116d3c728909d55104a09a7

            SHA512

            c11785ac0b34492d69b45da3d3e489d819be28ff0f34f00bb6825934b74f94cdbe2f548eddd9c5d54dbba5f2664835b56323dc2d8159f04beb1552c072e96e4d

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_helpers.cp38-win_amd64.pyd

            Filesize

            47KB

            MD5

            5bf893cde770aa22603f7d2ac1371c0d

            SHA1

            41f75dfa82550c84acc0e0efec53a921140842d3

            SHA256

            7ca04ff9661acf7bffcb3e557b0d82f12574c499d2c5b213d92b77afc43e17be

            SHA512

            c79d41b568ef52bcfe2555f1a6dd74ae8251dd984ecb03b9ecc35a8e2c8f84f2cd994d156b1df81a823c8f7fb1446989cc60182fb2b382ee217be258d52d9c16

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_http_parser.cp38-win_amd64.pyd

            Filesize

            19KB

            MD5

            3e24f00f7214a3e83d3df63639596932

            SHA1

            808129c1799fb62a53f376526b1fe15f39a4dfcc

            SHA256

            37e8d7998f35fd834795d8a288e91dad3693297a54ad4b4fc6ec734a931b8c18

            SHA512

            febd337977c2f2310b99eaa11213afd68feb12f8150622e98957a5d6d341c5d6359dd7a2074d156378b3dbcb5f44c1308184741004831e850472be16321c50bd

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_http_parser.cp38-win_amd64.pyd

            Filesize

            70KB

            MD5

            57b1cb963099a779c509c8547293e0d1

            SHA1

            781fb3035521fc4e05421706cd4ad8bba41ac6ba

            SHA256

            add39bebba808bcb968f5c3504d81cd9fe2bc4ccd845b7d09f9c75d0f5991ba5

            SHA512

            af5cdf4cabefc0b545c68b0943b2b1788c5d094d5cab9da20e162bd08740250abcdae7e4586580475b2c88373060ac16c7805a866a723d00fa5cdab5456d18ba

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_http_writer.cp38-win_amd64.pyd

            Filesize

            41KB

            MD5

            cdd7e78befd976319921ad58e871b026

            SHA1

            28b56d22e52cd2842504ea999a17c96e075313c9

            SHA256

            ad13169f77b799492f4051158997bdf9bca5a52eb1c834e9b385c60cc5619dcb

            SHA512

            1ba3ee6f535cfb67c9ea618db2841c1afa99a2893f93a240e28f57a5f225a868653bcb929077ff9eb42e7733c1320663d009e6bca70883ee857ab721943f0e19

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\aiohttp\_websocket.cp38-win_amd64.pyd

            Filesize

            28KB

            MD5

            9a6c957ffd7186ad86bdf823a416975e

            SHA1

            b269925b19f7c4b87bc2f2eecbc17d981c7ef98d

            SHA256

            9723dd25eff1cbf3d5d2da25604a2bebacd2476b38c2872aeaf3b6a3403a584e

            SHA512

            6e35dbed54a68f33999a20e18715d44420c3a21f05f85b0f465f3275729047335759467e16f9d757b1ea166e4736df98bea56cb58b7721d36f70e7d7f9872466

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\base_library.zip

            Filesize

            406KB

            MD5

            6579ee39f78cf2a0358f2732aa33d5f1

            SHA1

            aefe1fbc3ddb9789c2002a653d969b2ddd8ad636

            SHA256

            6595d5f6b85e7fdde8241d31fc23ee01975ba3917af164ac5aa5fc07fa269a4b

            SHA512

            8498f9958f7765acd9f4adeef266fc3a38db01d24ac11ee38130867534e1172671829c0c16acecffc248309e0ec9884e43b6cf3f52a1b815b1fde5db7db334a5

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\certifi\cacert.pem

            Filesize

            32KB

            MD5

            f5565de61705c7cc69571983554e304e

            SHA1

            080aaaf73dde6c7028d600031281cd97bea60e24

            SHA256

            684f96689b506b9537ef645a75e9c09be16570edf571e6d6af2b2b4ed2490c03

            SHA512

            d83ac0771a920ae809a4695d6ae24c44148c0795b457820e4f36c0497feac8503b623d85bc187cb338550130997175394c812e56f1c2ff96d54d7a6e28b9886a

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libcrypto-1_1.dll

            Filesize

            503KB

            MD5

            bf57dfd376a243d17135a0d49b8844e6

            SHA1

            5ddfa29ca8dbfb1f2e58f443286a6095c888d94d

            SHA256

            84f11a0b413a36f2a860cec9ac55de6eeeadd4aa00fe50eccbc49259f6b645a1

            SHA512

            0064549006c729663b1883c9245f13402bea4b3bf12acc7666a63f5abe68bd24672fa499b515739bde2abfa744714036f6f9899cfe925be1ff8e8a61cbce26a7

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libcrypto-1_1.dll

            Filesize

            252KB

            MD5

            33b912ba492a77286b63d9df3a542583

            SHA1

            52656f1b9bca1b187bfb07d9958f8fd4c2675b26

            SHA256

            51dcf4f337401601cf661aa90659e9d8d216c0c7221cac59e6bb4c14b1c285bd

            SHA512

            bf0cee3a07a1b01d88e92d128b3acca7998c70c5feb96ce665e00cdc4e59667f9fec2bc3f885f92c0a2eed7c43d20d2afec608906f9c1682db7aa343c4c6ecdc

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libcrypto-1_1.dll

            Filesize

            177KB

            MD5

            93854601118ab4555889293f6b1d36d2

            SHA1

            c43d722bed0d369ce71a4bd6e6c35f28daff10f7

            SHA256

            9a4d3ddb459492af201b7b14439fbaad812d4b226be789638f6055d244c17d49

            SHA512

            01b91838fa04dea0b5c59b78e88b2a3b20624200f312ba8645996dc7a27e37c5983300c3380a5887261b56469c69d1d0120fefedc8896543df64a4965abfc60e

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libffi-7.dll

            Filesize

            32KB

            MD5

            eef7981412be8ea459064d3090f4b3aa

            SHA1

            c60da4830ce27afc234b3c3014c583f7f0a5a925

            SHA256

            f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

            SHA512

            dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libssl-1_1.dll

            Filesize

            297KB

            MD5

            1a9ada3888b92559f44e2ee7f11d6ad3

            SHA1

            cc1a42b58abd4a61e9a81067ce40500211b3906d

            SHA256

            a57d43e4903027f42946d7c7ef4bfb52ba7d8759e221f56a08445c2616c92fa9

            SHA512

            31b5becc0400de95ec87a08313dbd527ef170dceef5848666fb8c4a0ca57069a8153be62efba7e83b59b68ed90d7761cbe396d2425886c67affbf63d52b3ff26

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\libssl-1_1.dll

            Filesize

            447KB

            MD5

            91a0be1bfb2a26dd23a77a13e0c2f1d9

            SHA1

            2fe3b3c5ba7eb6d1c91b0c4d329d7c290e2ebb85

            SHA256

            41d29dfa7700999e0087429a587939d353edecf785d148be588f18e2f84ff0df

            SHA512

            5ef8dbb556bb6e153ecfcf5f8fe9c8caf1126ef810eb90f1082d0361bee860fc830694406a91c0d0835e4c0c9960b928898f57e2a8e36bd59bd51d3955674abf

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\multidict\_multidict.cp38-win_amd64.pyd

            Filesize

            43KB

            MD5

            c43c2103add8c6c30f25b9e46e086147

            SHA1

            7a04d0dafcbe1036033c99d3e796422cba382796

            SHA256

            d31834c5ba38b1654ccecdad6423d2c15fe58593f2dfba291ca0753e5ad2f8ce

            SHA512

            b1d4f101543b1788c0e6137ff8c32b362082174618dc0ef888c692bde0fa54c182e4e2d8b7137e7cb20c1621336bc388aff6f88015ce4714c11254c10462e9bc

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\python38.dll

            Filesize

            4.0MB

            MD5

            362a9fb8e3d68e77f9240148b7f3e89a

            SHA1

            246bf7a10c0bdf8d2619f4ba76e919daf7c093e8

            SHA256

            948d2f9f8f9be769a1acdfa084c5b6df88eaff45d696c23b79759aeef9b35766

            SHA512

            e974f821afc8c3dd9ba6716a479b9ba5e5628ace4dfc2b0b2f432869b7ab43237017937ea6a0578b9a635714ae4355be1a6061088fcbfd1126f1e1206f711973

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\python38.dll

            Filesize

            1.0MB

            MD5

            1b44c5c0c585451d949553ef7cbcd548

            SHA1

            a619edf25f4e7224e0085f8b69762202471abfab

            SHA256

            5f7a35d3657f14cca1de6b3cafca733ce562aa2aa4ce89f4e18c416a593fb672

            SHA512

            d3d76eb93fe2d5e7a89720d8c2891c27d1d77aa87a6612e57637d3cb12fb360f943af75e540e3475e6bcce76de89375511adf600897acd0c9372847abc91a109

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\select.pyd

            Filesize

            27KB

            MD5

            6e3e3565f98e23bee501c54a4b8833db

            SHA1

            a4c9ecbd00c774e210eb9216e03d7945b3406c2c

            SHA256

            71a2198c2f9c8cb117f3ea41dc96b9ae9899f64f21392778d1516986f72d434b

            SHA512

            359aac4a443a013f06295e1a370f89d4452ea75fd2d11776f4eccf605b59caf529baffdcc3cef3eeb59e44a42beaf927bed908b507ac479cccc870768a620fed

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\unicodedata.pyd

            Filesize

            115KB

            MD5

            a7dd4253a5ea147c20705addf3ecd2b7

            SHA1

            c07de821ab6e26ada7ed8196a0d444753dc862c5

            SHA256

            bf51841b891b953deb807d8ddc66a8e3d0959cc9c1a2e8f80f9ff478fd562877

            SHA512

            8e3afa56d931b77a7cd08e1cca237782ce389bc42c8b4b416cb5be680078da291daa9c99da04d0ba39e7ed51030f27ace4ca6b2cf51cdbda61c0a90d050054ea

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\unicodedata.pyd

            Filesize

            155KB

            MD5

            7ac44577f068b5506a1e2c1871cff037

            SHA1

            60a62f033de185e4f4859093239524555567fd5d

            SHA256

            50b83faf8a05257a07ccdacac84494bca2f20504e736190e03d03739c27ae68b

            SHA512

            348fc18616204e389b0dd6dc6820f607950b36608eadcd411e8343a6d979252e67ae03133fa097d96ce7c1d6ab76e965caf8bf2cf28f8607d0f31abd36a459c2

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\yarl\_quoting_c.cp38-win_amd64.pyd

            Filesize

            57KB

            MD5

            8cd0fbd8b75941c517986b0e386fd3cd

            SHA1

            3f68a327a087558adf8b9312b9d6086c5a6d8087

            SHA256

            ceef5db7dc01d495081401496765243bba5c6ce9e27838f953461023c0fa6d3e

            SHA512

            4dcdff68ec920d6b7d2062d353e09072126611aebdf7074c377d3f9710958298842ceb16a6f2a24609606edd42ecc199b0de13f0bd9ec3c8ed4d49946a85e11b

          • C:\Users\Admin\AppData\Local\Temp\_MEI30962\yarl\_quoting_c.cp38-win_amd64.pyd

            Filesize

            78KB

            MD5

            e96e99fc84249de9c4cd4649f3a27f7b

            SHA1

            4fcf885311d24a2ce438842bb7db269550709a00

            SHA256

            3730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303

            SHA512

            19aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79