557acc15e084ff2e86c604d4d4f8a3ba09a44038f54484b8ec81519b85903e50

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.55.3/smile-dokkan.exe
Size

155.6MB
MD5

0c6f329816eb10ebc880512d0633d9cc
SHA1

5884ab65736e573a758344972233d1d1d374507b
SHA256

28f52244c4959bbbc4a39d239efe4f363741eb0b35d30073a8ab7dae92fc4637
SHA512

c8fdb011f5af67d36771ec76af6943e4bb76973700edc52d8a22b86430a3bd613544b320c163ce9980670ff519647d71980fba09865bef5cbea34c233d3d4665
SSDEEP

3145728:ZMddukP4gwPvP+4tG5YqtSC++PyfR23+5C4HjkUhWqKvMN3mPg:ZMu/gwPXjtGavCByp23iCYjkUh0YmI

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe
2320	smile-dokkan.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2320	smile-dokkan.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2320	smile-dokkan.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2320	768	smile-dokkan.exe	96
PID 768 wrote to memory of 2320	768	smile-dokkan.exe	96
PID 2320 wrote to memory of 4080	2320	smile-dokkan.exe	95
PID 2320 wrote to memory of 4080	2320	smile-dokkan.exe	95

C:\Users\Admin\AppData\Local\Temp\1.55.3\smile-dokkan.exe
"C:\Users\Admin\AppData\Local\Temp\1.55.3\smile-dokkan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\1.55.3\smile-dokkan.exe
  "C:\Users\Admin\AppData\Local\Temp\1.55.3\smile-dokkan.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
1⤵
PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI7682\PyQt5\Qt5\translations\qtdeclarative_en.qm

Filesize
16B

MD5
bcebcf42735c6849bdecbb77451021dd

SHA1
4884fd9af6890647b7af1aefa57f38cca49ad899

SHA256
9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

SHA512
f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\_bz2.pyd

Filesize
78KB

MD5
d61719bf7f3d7cdebdf6c846c32ddaca

SHA1
eda22e90e602c260834303bdf7a3c77ab38477d0

SHA256
31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb

SHA512
e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\_ctypes.pyd

Filesize
117KB

MD5
3fc444a146f7d667169dcb4f48760f49

SHA1
350a1300abc33aa7ca077daba5a883878a3bca19

SHA256
b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68

SHA512
1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\_lzma.pyd

Filesize
151KB

MD5
afff5db126034438405debadb4b38f08

SHA1
fad8b25d9fe1c814ed307cdfddb5cd6fe778d364

SHA256
75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0

SHA512
3334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\_socket.pyd

Filesize
74KB

MD5
f59ddb8b1eeac111d6a003f60e45b389

SHA1
e4e411a10c0ad4896f8b8153b826214ed8fe3caa

SHA256
9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da

SHA512
873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\google_cloud_storage-2.10.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pyexpat.pyd

Filesize
191KB

MD5
4cb923b0d757fe2aceebf378949a50e7

SHA1
688bbbae6253f0941d52faa92dedd4af6f1dfc3b

SHA256
e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc

SHA512
9e88542d07bd91202fcf13b7d8c3a2bbd3d78e60985b45f4fa76c6cd2a2abdee2a0487990bea0713f2ad2a762f120411c3fbbfaa71ef040774512da8f6328047

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\python3.dll

Filesize
61KB

MD5
704d647d6921dbd71d27692c5a92a5fa

SHA1
6f0552ce789dc512f183b565d9f6bf6bf86c229d

SHA256
a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769

SHA512
6b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\python310.dll

Filesize
3.4MB

MD5
2a65aee118ac60306123ff53c275307a

SHA1
52d1749a2acb6bfb0066ab13366dae70fc8cedc5

SHA256
f013838d7503313805939d9030dee6a874f77b66392211e00a8cc755f3f13df8

SHA512
fe77633d952062ab73b05aab64a1a026e8f51bc8e21643d0aa16b8ca138a2eeab260aa7a1a27eeaaa58a7f4380c6a0d0f6f4d5763309c3db999c595fca8d93cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Africa\Conakry

Filesize
148B

MD5
09a9397080948b96d97819d636775e33

SHA1
5cc9b028b5bd2222200e20091a18868ea62c4f18

SHA256
d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

SHA512
2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Africa\Kigali

Filesize
149B

MD5
b77fb20b4917d76b65c3450a7117023c

SHA1
b99f3115100292d9884a22ed9aef9a9c43b31ccd

SHA256
93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682

SHA512
a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Africa\Lagos

Filesize
235B

MD5
8244c4cc8508425b6612fa24df71e603

SHA1
30ba925b4670235915dddfa1dd824dd9d7295eac

SHA256
cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

SHA512
560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\America\Curacao

Filesize
246B

MD5
adf95d436701b9774205f9315ec6e4a4

SHA1
fcf8be5296496a5dd3a7a97ed331b0bb5c861450

SHA256
8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

SHA512
f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\America\Toronto

Filesize
3KB

MD5
44a2dd3cb61b90aa4201c38e571a15ba

SHA1
73f6ad91b2c748957bdaec149db3b1b6b0d8ac86

SHA256
820392cdb1e499f82ef704d0ccfd0c50ab2b28c6e0bdeb80793861d5e165d5ad

SHA512
11ddb971c65c2f4ecc690ef685163f2972c089660f4778997964d89113a403030927edbb2ed397b81cf61bde9276add6a43ee8ee92dfa69a6d102b035fe9f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Etc\Greenwich

Filesize
114B

MD5
9cd2aef183c064f630dfcf6018551374

SHA1
2a8483df5c2809f1dfe0c595102c474874338379

SHA256
6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

SHA512
dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Europe\London

Filesize
3KB

MD5
a40006ee580ef0a4b6a7b925fee2e11f

SHA1
1beba7108ea93c7111dabc9d7f4e4bfdea383992

SHA256
c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

SHA512
316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Europe\Oslo

Filesize
2KB

MD5
7db6c3e5031eaf69e6d1e5583ab2e870

SHA1
918341ad71f9d3acd28997326e42d5b00fba41e0

SHA256
5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

SHA512
688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Europe\Skopje

Filesize
1KB

MD5
6213fc0a706f93af6ff6a831fecbc095

SHA1
961a2223fd1573ab344930109fbd905336175c5f

SHA256
3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

SHA512
8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\PRC

Filesize
561B

MD5
09dd479d2f22832ce98c27c4db7ab97c

SHA1
79360e38e040eaa15b6e880296c1d1531f537b6f

SHA256
64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

SHA512
f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Pacific\Wallis

Filesize
152B

MD5
5bdd7374e21e3df324a5b3d178179715

SHA1
244ed7d52bc39d915e1f860727ecfe3f4b1ae121

SHA256
53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

SHA512
9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\Pacific\Yap

Filesize
172B

MD5
ec972f59902432836f93737f75c5116f

SHA1
331542d6faf6ab15ffd364d57fbaa62629b52b94

SHA256
9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

SHA512
e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytz\zoneinfo\UCT

Filesize
114B

MD5
38bb24ba4d742dd6f50c1cba29cd966a

SHA1
d0b8991654116e9395714102c41d858c1454b3bd

SHA256
8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

SHA512
194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytzdata\zoneinfo\Africa\Djibouti

Filesize
251B

MD5
9953f5fda89eba25650d5e42adda36cd

SHA1
cc8958cc687a1f8169316cd7a93764403e935740

SHA256
52e9bc212ce945a0e1f37d223647d1bdaf919fa353bae1873568e28390b6f59a

SHA512
61b92a1a9978a58597f2fec6949605ee0fbcd7e4a4e31861a0647c20d1ebbdefb01c72a9f24a77807a1129c6720f3a1fc0e7fc9ab83789caebfc69a9540ce763

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\pytzdata\zoneinfo\Africa\Lagos

Filesize
149B

MD5
3b4db0742fa8267a2d7efa548a30f9a2

SHA1
cdca88d4a729d78b572a5d3cc84f3e99989e4f46

SHA256
c6a2cd1aa6e31d9d49b881ec1173fdb6d5d26f7bfe196a7df12275e292fab14c

SHA512
fa356585caa8325d3f74251256c3ca2b894904dcdb7ad5f2ed6bb7ec12c98fdf3d69a080a0af413ef7ca101f9ccbc2fb28fb6d5d6a6d2f84281ccbd798fbb6da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\select.pyd

Filesize
26KB

MD5
994a6348f53ceea82b540e2a35ca1312

SHA1
8d764190ed81fd29b554122c8d3ae6bf857e6e29

SHA256
149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4

SHA512
b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7682\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
\??\c:\users\admin\appdata\local\temp\_mei7682\google_cloud_storage-2.10.0.dist-info\namespace_packages.txt

Filesize
20B

MD5
8e70e613444d33caa4851b98e74f10f8

SHA1
509983c76d9be2fe753f63a6334b5a24d1a2328d

SHA256
bfc21a62a444d9ad289c018922965e164907f37c1749665147d78ec9f330a137

SHA512
bd40d18144656a5486e0e417da0ecd651a01fdc0b6274076cbfc0252e83b9dcf5a18c7e8e583f87be1fa2a26d96807f81d414b8154f7f02b13edd52c09c06d7e

Download Submit
memory/2320-5219-0x00007FFEBF100000-0x00007FFEBF4F8000-memory.dmp

Filesize
4.0MB

Download
memory/2320-5218-0x00007FFEBF720000-0x00007FFEBF984000-memory.dmp

Filesize
2.4MB

Download
memory/2320-5215-0x00007FFEC1170000-0x00007FFEC13D0000-memory.dmp

Filesize
2.4MB

Download
memory/2320-5216-0x00007FFEC05A0000-0x00007FFEC0A80000-memory.dmp

Filesize
4.9MB

Download
memory/2320-5220-0x000001E22C1E0000-0x000001E22C1F0000-memory.dmp

Filesize
64KB

Download
memory/2320-5217-0x00007FFEBF990000-0x00007FFEBFED1000-memory.dmp

Filesize
5.3MB

Download
memory/2320-5223-0x000001E22C540000-0x000001E22C8B1000-memory.dmp

Filesize
3.4MB

Download
memory/2320-5222-0x000000006E4F0000-0x000000006E595000-memory.dmp

Filesize
660KB

Download
memory/2320-5221-0x0000000061CC0000-0x0000000061D65000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads