Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 15:17

General

  • Target

    77b3333cabe2d5041127bccdfa6da28f.exe

  • Size

    11.6MB

  • MD5

    77b3333cabe2d5041127bccdfa6da28f

  • SHA1

    4f3e07889bb478e038f6f49dc509d4b3a75a50f9

  • SHA256

    5e852a04af0d33a74c67ba22d6cdcf9371217dd5f71be4bf5adf61d1ac6492d5

  • SHA512

    edc4402ee676397c44c23c0b57b396767b7d77f76bfda0ac6a719b21b0de9a3754b91b63baaad84de7824655181ca299c9f5d2bbedcf648afc44bcebbf086371

  • SSDEEP

    196608:kHlAG6ZjgDzrF0Dn/RNrlHAjoG+IE9onJ5hrZE8hbJMFjfk5ZYiMF3INQu0lRfep:YlCuvB0LZxlHOFE9c5hlE8hyFA5ZYg/w

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 45 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe
    "C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe
      "C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_Salsa20.pyd

    Filesize

    13KB

    MD5

    86109d2d1fccdb91968b7c1a63823731

    SHA1

    89dec67fbb4e467604f20c53c3ae3949471aef58

    SHA256

    28efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9

    SHA512

    5d331f7f3ca413e77c33fa57e1f07ef43d064545ff1d143b9086211b42bbe165564c62b07d7a44615e75221613f3d3127ef5d7c7ec06315f0c397c0b059d2a37

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_aes.pyd

    Filesize

    35KB

    MD5

    e6c16a8f39eb63ee3c75c3498bccb35d

    SHA1

    b28cfdab4f11b1ad1ffe52847b275fb3b356fe2a

    SHA256

    6e1ae3d0bae24c9641d96719eb4e941a6ed17c1e1b90d8b7478d6f7cbf9c4d9f

    SHA512

    daa2ff6e68fbe8062e46433fdd32382ce88dadcac400a6882961828583e73bbfbea1bca80690b13ba650e9e899b7ef41a86faafccf1719868cdbfdbc07623820

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_cbc.pyd

    Filesize

    12KB

    MD5

    ff9b1e03922361e0a8be65e5e1421aac

    SHA1

    d4d674fb4e0214903e341e98613328d51aff9054

    SHA256

    2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df

    SHA512

    8cbbbbdc9a3d9e866dc88a655a75317f58cb4a49cb262975ff8c4ae5d47c344b86f69f6d2fc369dd7aa8ad7fcaa40d1937320e7e4f5923a03a39459b7bb247c0

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_cfb.pyd

    Filesize

    13KB

    MD5

    06358818f111a1c8e1b76d60a650c997

    SHA1

    5bbaf40aeb932766346631df25d887264aad7ac2

    SHA256

    b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180

    SHA512

    f954b4e56e3ace2c8e0961149cb5bd433f35530bc1c5e38ec5d2223ec3591df0998903b3928668c5d8c05f16eaa1c2adf41fc999690c42dafa794800fc4b193e

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_ctr.pyd

    Filesize

    14KB

    MD5

    6adf70fd22d5ca90269466e5fc2aca2b

    SHA1

    1d4cdf2b08154b33738c5244a8886284c71693b9

    SHA256

    2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4

    SHA512

    efbd7133e5b5ef035f5a09d92b3b12d3ad367d6c35856a842536102d36a1ef53afe62ea3c3a5a4ae641bb28b6caaed18afa3519a637aa36f71f71979d4f61239

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_ecb.pyd

    Filesize

    10KB

    MD5

    64f6350fc1145db6337a9e3dfb83222f

    SHA1

    fea799c3f2a655d5104a46b788d98ea272557ae5

    SHA256

    821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e

    SHA512

    58f90099630b98a632db38d7cc4a2f44c70bb012f55b3b5a69dffc3a76f6a2b30ab81d678b95e807c135b96633a0d8ed83428924a1c9d1dfdb7f2a3962a44d31

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_ocb.pyd

    Filesize

    17KB

    MD5

    9cf1780e69e1bf2df2487b4de72806e5

    SHA1

    0955d77afb6a8e786dcbbf4f0b5b221bc302c6c8

    SHA256

    59cf35c376f312b1c6a5844f0740fcae4caaa5a3d3cd0e953959b5f4190a475d

    SHA512

    b1c4e6841c739fccc86e95da53ae10c3efa18f3a747b8e92883e7224cbe4f44016102fb6f713aa4345ba37dbf7c07d5517dfe9d564e2d4d120d154fd7de717f9

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Cipher\_raw_ofb.pyd

    Filesize

    12KB

    MD5

    670c2baf75e559b89435283298f75bef

    SHA1

    be1e5a0711c6c0bb1e2aef4ed18a15ed5759b027

    SHA256

    236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06

    SHA512

    52554fe5308f7b758b66b48262aae1c180191358e15fdd85b7d5ef47a35677e079c3ef6a54e63d1520038bbfc79bad5b2534b1c2808217ffb53c55b7e8862fdb

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_BLAKE2s.pyd

    Filesize

    13KB

    MD5

    9098b9c8340047c6434825e18826cc18

    SHA1

    85dde191f6549aca0813d8a723d39b83c61002db

    SHA256

    825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e

    SHA512

    defc6852291b568793a48124184342272f4bc424f88de82a35335d5596dfacc93a52afc33c43337e4ceb800c5bd998493a7ba7f52c02a6027a4434d7e608fcae

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_MD5.pyd

    Filesize

    15KB

    MD5

    2f4c07b5fc3c6245b0e1269c0d1a5a97

    SHA1

    26ea9baabadf63e5a44f3b606139f249bd120b99

    SHA256

    efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27

    SHA512

    21e1ccbf238fd59c1ce80543a8f21858ae6e15ad1e8536a0144ec06791cd2488822ae87d84e331e9135142c76506e68fad7dbb4b26428ff3ac0d43f49e8fcc92

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_SHA1.pyd

    Filesize

    17KB

    MD5

    d2ef20fe88c483dc2588c03876058afd

    SHA1

    86a7a9e71df94fec73dd90a9a4cf5b7901ce622d

    SHA256

    6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33

    SHA512

    d1ea9f01ea1a16b23b6219492b3d2a27b017ea8d5511549c82fe3a58da988b890e52d144630c55fd845b8d079c4b6d3fd2172020cecc5f6dd6a05b1495d18c71

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_SHA256.pyd

    Filesize

    21KB

    MD5

    363b8e9f9a119ee0a52d8e75083f3f5d

    SHA1

    e0f4316f5afd2abc31047b50fdd7910d148a7611

    SHA256

    1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3

    SHA512

    3862436b88dae084993772d6ebdd3c7a892a562045ce448bc6419c7c21c797c806ef6030157c8daf2e85a36b13ed0ce4475eb00e61ee0cbec4db2677e780f177

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_ghash_clmul.pyd

    Filesize

    12KB

    MD5

    6ffdcbb8b3860fab46a4666c97f17eaf

    SHA1

    87defb8a639e0af86b6943490eb5456d6d63183e

    SHA256

    2ea2b17aaac9e572eef1239b01e8ad378829b765958fd1bf306f39983a76f944

    SHA512

    769941e8aac1075415f27c272510eda7c6156a0f29f0a19523251367946340ef53315771e6985c91ff4314ba1fcb939b1d5cd197dcbdaaed272733c9875e9b5b

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Hash\_ghash_portable.pyd

    Filesize

    13KB

    MD5

    35025bbdbea7932bbe4e79627250dc46

    SHA1

    4082c2aba70d98fcf6ec2b82ff4cc6692d7b56ac

    SHA256

    800cc846930302519335afdd276f9cbbe5f940fe1e5035cb6baf4fb736d37434

    SHA512

    a65e3c17e2ef456258eec06e81fcfa9af97a0d13b05eaca96935e371aa5e768eba9fa2e00f6cb5930d25d57380654cd2b8c8cb680a686c912e5f36a3046e0db9

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Protocol\_scrypt.pyd

    Filesize

    12KB

    MD5

    dcd7e1c1f1e68405d66cef954cbaee38

    SHA1

    bbe8c8bde0e1956f4d88d737d50b2215073cdcb1

    SHA256

    0ec713f4f3e963f618873ff538c7dcc532e0faba5025c5a8e20ac089fdfcf1d4

    SHA512

    10d2048ff68515862b95e658bb33e42ed0fd2ab70db66f2738487d21739172d4f24ffb8f239fdfc6f479ce582a85c3b8f8adfb5024dad5769713a4b3d22d3115

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Util\_cpuid_c.pyd

    Filesize

    10KB

    MD5

    f35a4c3bb2fb8782c1c3f0d6b493ce77

    SHA1

    688c8baa950cfd77fdded246976829cc7510fce9

    SHA256

    a6feba74067fb03ee4ba53d1608ab8012eb6bd1f995ebc42c21d653d57b8320b

    SHA512

    5cb5219dd33ac40bd901298f17945fad21b25b0358056d10c84440048cf845bbb7acd0f6501d4284508b7559eae04074b03d13f6a1e4069df011895dfd3ceac9

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\Crypto\Util\_strxor.pyd

    Filesize

    10KB

    MD5

    db1f79a96a1390028df325dd183ff9f1

    SHA1

    8373b6c44fdbece2c1ee5327a2bb5e5b0a719ed4

    SHA256

    6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da

    SHA512

    dad71f250340e529883e3347e90e66a445641f019351e745940c6700145c6c923a9d5575efaf42436823bd8f1db44e9b00c99eb1cc41dc49425ea9db9847590e

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\VCRUNTIME140.dll

    Filesize

    83KB

    MD5

    0c583614eb8ffb4c8c2d9e9880220f1d

    SHA1

    0b7fca03a971a0d3b0776698b51f62bca5043e4d

    SHA256

    6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

    SHA512

    79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_cffi_backend.cp37-win_amd64.pyd

    Filesize

    177KB

    MD5

    47b879422f88a07aadf12201b370b851

    SHA1

    d64fb4865bbb495006bf9fff33e46f8a005b10d4

    SHA256

    f0a2c12614601f31262810c5830c00fd3e3658a0abba2d13b79caae27d6c55b4

    SHA512

    f691f84817994dafa9a644984783fb1283a3ad7d7eef27cc2d427a63de9ed6901d99454ce4aca3683d123cf8af12e6179b81275c4bb7a7cf1c905540ee1fac6d

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_ctypes.pyd

    Filesize

    131KB

    MD5

    bbf539c8cbd17225a8d596e037695fb6

    SHA1

    015b8903e8e83363c56c628d22cdd4c1466b0c4a

    SHA256

    ad503c075de4a19058d9232e4151f97e60d4cea76fe8dd0d5ac8b4a73074a603

    SHA512

    0533b0def1f6b516018de090ef11c4a04442a038f21c6d509d7f556cd764aaab16b58448b0afe7e32330dec594ac86f3ca091adcea531e664b33e228cbeb4ad7

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_hashlib.pyd

    Filesize

    38KB

    MD5

    697e768501131b184a4ca1a9181281fc

    SHA1

    237faec3070e0c62cf0ad31cb66f5513821d790a

    SHA256

    f7147a21de74e2e6f65d2d260cca97fc8f666b40d70eeb1a1d57a24b0ce12ae7

    SHA512

    bd85221384d38895bf7b4ef9e2d6088943975627458ca7a537bfbd7a671637d449274c0394820a788493727e2a088baf715b9d814a5d351b001636e47558c1cd

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_lzma.pyd

    Filesize

    181KB

    MD5

    2645aa11d8c4ffb04a8c5e04a440ec46

    SHA1

    a4a7250963d2bd9c6e76db3d0d11028395815856

    SHA256

    519f9e23d88ae387ea7d38bbc941a770a4b3ecc8c464a8ed0d977004344e4de3

    SHA512

    beaf0b144a3bbb1d5a8afd8601efe39f3a233eabe04e1aabd1e6fe3c68de640bf10e48dccc11576b8618b71307ac3019cd5a71d1e8014acd79955655c56bea9a

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_socket.pyd

    Filesize

    74KB

    MD5

    35bbb04a44f81a1c95216a2dfdb82516

    SHA1

    b7d8e69e2084e2d2a560b9ff2184f10de4576340

    SHA256

    697e0a45ebe100dce1dc4e11d11cd9e2b60d74ef4c7df1cefbe0e334d3997f7a

    SHA512

    742a1099c01f06a75c4f66c7399b3d85c064f1f24950f6f7101c1632048282dde6f9140bd3ddd2ee7230a31618ef483711f7b67a212deb3912d8319cfc6db6a5

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\_ssl.pyd

    Filesize

    121KB

    MD5

    8d4f033d412ae7cb92f71a030f06f7e2

    SHA1

    d8a0e1ad4e53f7ee6a59b12e9d096a704fff3809

    SHA256

    74be594d02bca5ac096ae2d34786628a873e00f231e922d7842d2cd0ceedc33a

    SHA512

    5b177a13f1f4ea552a348aefbe014d8394499c032b9bd39df8150cefec037d467655e00a2063aaefe36704969a9fd6a5d71776ec7ce966fce454e2c8a295cde0

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\base_library.zip

    Filesize

    760KB

    MD5

    28912e44ef0184bde6985434aea2ea0f

    SHA1

    2983c2676458f1566e40d836eab93162e59a82dc

    SHA256

    d8007cc9e158ceb6760a6d83016607dbfcbcaa5ab09068b85211c56f04862655

    SHA512

    090718e1a802425ff188426281fcba1fe8c5d98f3beb3a1e504a534af31b7d9bd07f95fc85e3496ed771a92724fa025a780b4ee61a1d49648b9c765ca58186e8

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\libssl-1_1.dll

    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\lz4-3.1.3.dist-info\INSTALLER

    Filesize

    4B

    MD5

    365c9bfeb7d89244f2ce01c1de44cb85

    SHA1

    d7a03141d5d6b1e88b6b59ef08b6681df212c599

    SHA256

    ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

    SHA512

    d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\lz4\block\_block.cp37-win_amd64.pyd

    Filesize

    119KB

    MD5

    42d28dfc09aea43c507553b4d1fa240b

    SHA1

    3a15ad4954ad6cb40a9ac04cfbecf9862d7683f4

    SHA256

    8f446455e25bff5267b1d7f6eaac8b440250e4316327cebeb59890926130fa2a

    SHA512

    6a7b1762f9bce0547d30fbe3ba0b3320308b37f714259335b814ab216577777def7d05fb02622b702c34b2148e76bbeaf083f2cc5e6f8bd10a7204b1bfa9e1b4

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\pyexpat.pyd

    Filesize

    194KB

    MD5

    e6bfbe1d1ced9db37390b6e85099c89e

    SHA1

    ffe43b5c3efe6120059c85ca5fa951bb67076c3e

    SHA256

    11c731212e7c93fdff721d4f62ba1f90ef407298d5b4c7e7cfc04552f9be67bc

    SHA512

    fe5f305260629de597ed9a1e52bbff982cf2fff848e72f6ba4073899f4f5a05a88e8601531d7324ae676216037bd07c12918db2c55b7d2cb5457cf77928c7154

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\python37.dll

    Filesize

    3.6MB

    MD5

    d8a6dff4f79e66c2b05c3528b902f6fc

    SHA1

    62989fccc089f70cc3994a3352dfb222e8a07023

    SHA256

    b6166f6072f795c2bec5421cc3c762f0731d1aeb4b08c06f75e7d119e1256f72

    SHA512

    f3e819f57114ba2f05db64deb353d0af79cda0943887ce1fa669ecb7204ec5bae263f9cd5cbebc7ab73b8418cb3c9a3badfc6a377ff9dbc4a48e588f4d461359

  • C:\Users\Admin\AppData\Local\Temp\_MEI26722\select.pyd

    Filesize

    26KB

    MD5

    c05ff16ff578bc7d52f30528c2b17957

    SHA1

    3989ea93533431b6da8c3583513b05904b152de6

    SHA256

    1ce5454774bf7b280b11b2b94298d41787e9bde4466d157040dd6a0fd78e982d

    SHA512

    84b51276a8d463532713746d094144a69425921540657a8f15289fc9f6fe702ab38ffa4e163af48d2218435386e64eadd076612e0b6ea6b2d5c4a611dfd06479

  • \Users\Admin\AppData\Local\Temp\_MEI26722\_bz2.pyd

    Filesize

    87KB

    MD5

    ac11929e59fa2d7887703761d0aa01a1

    SHA1

    355bfdb64a7cd612c5ac1f86aa018de0bcb68f63

    SHA256

    4e8f2e01b8af90084af5454135a870b3e46002a81df56c60482cf153400a0e6d

    SHA512

    184dc08b56fdfc0dcfe1d3ff4095eb003c74fbbdb897ae0553accdc8a1aae4a8e69d138226e5063ee58348fbc7011224c3e6b988a9967bab74056d48a673b9f0

  • \Users\Admin\AppData\Local\Temp\_MEI26722\lz4\_version.cp37-win_amd64.pyd

    Filesize

    11KB

    MD5

    a889578241518ba4b51f2167ea13f0cb

    SHA1

    a649836b05c4beec51c8f6b6019e0cc773347bf5

    SHA256

    06ac6134e98d9ea625e635d9512a259cf43b724e9a3fc8cd3776aaff46d051d9

    SHA512

    3a470181d676ef7a3f8928497a0929ca1c30a93da9783d9e2d9a5ea313c9435a16aee5df5524119d2a177bd04ac6c4905eb1dd56764367263b549fdd9690621d