Malware Analysis Report

2024-10-24 17:05

Sample ID 240202-gftpfaheal
Target StudioApp.exe
SHA256 22442d487765e55be893d7b769b48bdcc193d537aada4435954d6cbdb0563d86
Tags
pyinstaller crealstealer spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22442d487765e55be893d7b769b48bdcc193d537aada4435954d6cbdb0563d86

Threat Level: Known bad

The file StudioApp.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller crealstealer spyware stealer

An infostealer written in Python and packaged with PyInstaller.

Crealstealer family

Reads user/profile data of web browsers

Loads dropped DLL

Drops startup file

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-02 05:45

Signatures

An infostealer written in Python and packaged with PyInstaller.

Description Indicator Process Target
N/A N/A N/A N/A

Crealstealer family

crealstealer

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-02 05:45

Reported

2024-02-02 05:48

Platform

win10v2004-20231215-en

Max time kernel

90s

Max time network

92s

Command Line

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StudioApp.exe C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\StudioApp.exe

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

C:\Users\Admin\AppData\Local\Temp\StudioApp.exe

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 api.gofile.io udp
US 104.237.62.212:443 api.ipify.org tcp
FR 51.38.43.18:443 api.gofile.io tcp
US 8.8.8.8:53 store8.gofile.io udp
US 206.168.191.31:443 store8.gofile.io tcp
US 8.8.8.8:53 geolocation-db.com udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 18.43.38.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 212.62.237.104.in-addr.arpa udp
US 8.8.8.8:53 31.191.168.206.in-addr.arpa udp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.135.233:443 discordapp.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 253.102.89.159.in-addr.arpa udp
US 104.237.62.212:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.135.233:443 discordapp.com tcp
FR 51.38.43.18:443 api.gofile.io tcp
US 8.8.8.8:53 store10.gofile.io udp
FR 31.14.70.252:443 store10.gofile.io tcp
US 104.237.62.212:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 252.70.14.31.in-addr.arpa udp
US 162.159.135.233:443 discordapp.com tcp
US 104.237.62.212:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.135.233:443 discordapp.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI32722\python310.dll

MD5 1a5ced04216e75b8692d002a9e618137
SHA1 1bea26a764268a22a6fcdf27b0bb24dce65b0c17
SHA256 79861acd0beb7c64ad8bec2471a0aaaf2810de637e41405e0b9b98236977bb0a
SHA512 0418c6044a2312f8e5da9b867d877cf2a1971ab39308d54648bd03c3578dec3ee43e30a2f6cc17ab29c120650ce4031ffd89cf40bf09112faf5a404a38ef5b6f

C:\Users\Admin\AppData\Local\Temp\_MEI32722\python310.dll

MD5 3c272531eb4914fc79c138b3c819aafb
SHA1 d640421e0df04d077583421138a7a2ca81f66b8c
SHA256 eee604d01134a811fe24e128ae83941e797254a974f0e0a4b4581b800702d9c0
SHA512 f4f7f721fc76b85f3bcdc1c0dba9b462de76e8779ecf27bd02d6a7451a7a5dd3fa1fa4d0aad4032f7c50bd4d8f464b38a489bb6a81119f10bafcf7e81cfe7a39

C:\Users\Admin\AppData\Local\Temp\_MEI32722\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI32722\base_library.zip

MD5 24822808dd7b4cac7e8a79e070e7e636
SHA1 26bd628a3bf26adf357547aea9525d5ecddfdce5
SHA256 a63aac4d7d17736b16d41a6bd9945c933233a193caea2c64c01e128355a118e9
SHA512 c6d113223e6cb2b1bb17c37564cc3f01247b944baa994c9352bb1f024d24c1dd77cefd32469e6bca6a6b503edf521d1b679b0812e235879f3ca3bc0feb058a5b

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_ctypes.pyd

MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

C:\Users\Admin\AppData\Local\Temp\_MEI32722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_bz2.pyd

MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_sqlite3.pyd

MD5 9f38f603bd8f7559609c4ffa47f23c86
SHA1 8b0136fc2506c1ccef2009db663e4e7006e23c92
SHA256 28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319
SHA512 273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72

C:\Users\Admin\AppData\Local\Temp\_MEI32722\select.pyd

MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

C:\Users\Admin\AppData\Local\Temp\_MEI32722\pyexpat.pyd

MD5 43e5a1470c298ba773ac9fcf5d99e8f9
SHA1 06db03daf3194c9e492b2f406b38ed33a8c87ab3
SHA256 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65
SHA512 a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pywintypes310.dll

MD5 ceb06a956b276cea73098d145fa64712
SHA1 6f0ba21f0325acc7cf6bf9f099d9a86470a786bf
SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
SHA512 05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pythoncom310.dll

MD5 583df8d3cf13e94465e22a423c7b13a5
SHA1 85d72221a5c02b6eff531fac69935f8964d8896b
SHA256 878f48a9b2c2e51d6ab9468b14bba76069ffc384322c2f8fd73aaf6b08545875
SHA512 2f6cd60693614acd6d8af86638243d2e38551b815f20ccc335ba61e501494cfa214164a1d454a5f816468bd51ce6ced70437d76a8ae3228415d2e46e935f64d2

C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pythoncom310.dll

MD5 0f44f94f8285b64e39162238a1329b27
SHA1 251cfa149af0d74586877db9c4436424db00c9f5
SHA256 317429c5c908b013003bf4ca4419ef563f3faaf7f78492a4e3f2a5df54ef4598
SHA512 3330499d0f8881b13b8f3790927d2a1ac9935dd8f7880275c0de6514d4e603f3219295bc91863706d55da210619c55682b13c3f7600fe16508c823eb3daf7982

C:\Users\Admin\AppData\Local\Temp\_MEI32722\win32\win32api.pyd

MD5 00e5da545c6a4979a6577f8f091e85e1
SHA1 a31a2c85e272234584dacf36f405d102d9c43c05
SHA256 ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee
SHA512 9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_ssl.pyd

MD5 9ddb64354ef0b91c6999a4b244a0a011
SHA1 86a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
SHA512 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca

C:\Users\Admin\AppData\Local\Temp\_MEI32722\libssl-1_1.dll

MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_hashlib.pyd

MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4

C:\Users\Admin\AppData\Local\Temp\_MEI32722\unicodedata.pyd

MD5 1664cbe7200b4214e7d7c43e11249693
SHA1 c74f29ff037d5252014fc52e33a28e005299c2bd
SHA256 3a57d912ae0bfa52dea621c49b48eb3a461dd3112527705ac0216782bdb9860c
SHA512 2ca0c24a7c6256a3dafcc267669d52493e62b7ae3fae94f229a018564cfa16308e3d78a7daa67abe0c3d37709a3e6879414bc943a6ec39f0c11bc24f1ffbeb10

C:\Users\Admin\AppData\Local\Temp\_MEI32722\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

MD5 494f5b9adc1cfb7fdb919c9b1af346e1
SHA1 4a5fddd47812d19948585390f76d5435c4220e6b
SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
SHA512 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_cffi_backend.cp310-win_amd64.pyd

MD5 ebb660902937073ec9695ce08900b13d
SHA1 881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA512 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_ecb.pyd

MD5 dedae3efda452bab95f69cae7aebb409
SHA1 520f3d02693d7013ea60d51a605212efed9ca46b
SHA256 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a
SHA512 8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c

C:\Users\Admin\AppData\Local\Temp\_MEI32722\charset_normalizer\md.cp310-win_amd64.pyd

MD5 f33ca57d413e6b5313272fa54dbc8baa
SHA1 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
SHA512 f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_uuid.pyd

MD5 041556420bdb334a71765d33229e9945
SHA1 0122316e74ee4ada1ce1e0310b8dca1131972ce1
SHA256 8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6
SHA512 18da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3

C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_cfb.pyd

MD5 3142c93a6d9393f071ab489478e16b86
SHA1 4fe99c817ed3bcc7708a6631f100862ebda2b33d
SHA256 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586
SHA512 dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef

C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_cbc.pyd

MD5 0c46d7b7cd00b3d474417de5d6229c41
SHA1 825bdb1ea8bbfe7de69487b76abb36196b5fdac0
SHA256 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1
SHA512 d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864

C:\Users\Admin\AppData\Local\Temp\_MEI32722\sqlite3.dll

MD5 7da2e34f51395618a9eefa40614a8edd
SHA1 0b7be3a9ea1232611601c545afad10a936ccea23
SHA256 f7a2c99d75ca0778d26c62981888756e2b7415e8cfc2f837bdc4b885022329bc
SHA512 b8d82291eda5250e0af1c356005a7a17b8bd98bd4f3e8863c03b34769a3e74b181f4eacaf5425d374a771cd25a506f3c0ace37ce61be4641148d6aeb73835dd2

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_overlapped.pyd

MD5 02c0f2eff280b9a92003786fded7c440
SHA1 5a7fe7ed605ff1c49036d001ae60305e309c5509
SHA256 f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
SHA512 2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_asyncio.pyd

MD5 4543813a21958d0764975032b09ded7b
SHA1 c571dea89ab89b6aab6da9b88afe78ace90dd882
SHA256 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
SHA512 3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll

MD5 b06e0b2098b1eedc5a9d439f3a43efd9
SHA1 ef17feeddffb86ee84e4298b17c6747d280c8eb3
SHA256 7cf125863b3f3bf4e067a1b7570d7f4dce0379e8675ab202e9a96f6ec35a92c8
SHA512 55bd7b9ca65521b8fdc5e36ba115db1b8e1582e097ab877ac8d25113672d1ee1babcd62013c4b475b9612dac674eca754678afbe4210f649b5b610bcc83b14e2

C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll

MD5 341ed5595c40259348521c0b765f4472
SHA1 009ef20bdbe681e82e61188c52a58e462cf08e16
SHA256 fcbaea90ea214e865b6da4815b7c3eda371be603afd50b7b585e7bb54388e7ef
SHA512 7e2c91e04420f01981d7927507ae2886c6ca6f3b75e177a0c4aa295614c4e04f3155af3b5737e07f71ca4d3f1d99efe64639cbeef149aea5f0e3e8efdf11339b

C:\Users\Admin\AppData\Local\Temp\_MEI32722\VCRUNTIME140_1.dll

MD5 bba9680bc310d8d25e97b12463196c92
SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_queue.pyd

MD5 52d0a6009d3de40f4fa6ec61db98c45c
SHA1 5083a2aff5bcce07c80409646347c63d2a87bd25
SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
SHA512 cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_socket.pyd

MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_multiprocessing.pyd

MD5 62733ce8ae95241bf9ca69f38c977923
SHA1 e5c3f4809e85b331cc8c5ba0ae76979f2dfddf85
SHA256 af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa
SHA512 fdfbf5d74374f25ed5269cdbcdf8e643b31faa9c8205eac4c22671aa5debdce4052f1878f38e7fab43b85a44cb5665e750edce786caba172a2861a5eabfd8d49

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_decimal.pyd

MD5 6339fa92584252c3b24e4cce9d73ef50
SHA1 dccda9b641125b16e56c5b1530f3d04e302325cd
SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
SHA512 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84

C:\Users\Admin\AppData\Local\Temp\_MEI32722\unicodedata.pyd

MD5 4c8af8a30813e9380f5f54309325d6b8
SHA1 169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
SHA512 ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a

C:\Users\Admin\AppData\Local\Temp\_MEI32722\sqlite3.dll

MD5 aaf9fd98bc2161ad7dff996450173a3b
SHA1 ab634c09b60aa18ea165084a042d917b65d1fe85
SHA256 f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592
SHA512 597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f

C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll

MD5 4fb97104f053555c648a19de3a03822c
SHA1 c632f971190d00e6dd7df5ae0ea05508696c01cb
SHA256 44d0b403323eab1d2e4a3217e84636061a0ebca222563b2588a281feb3e8e0b3
SHA512 c439fc1254f28d167577fb7d56dfc0796262507ef9c1a41ecae1d44bbf853765b891263d2edcb462d48fa239c814c43183d272865b9091469a572018d6d43585

C:\Users\Admin\AppData\Local\Temp\_MEI32722\_lzma.pyd

MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

C:\Users\Admin\AppData\Local\Temp\crcook.txt

MD5 155ea3c94a04ceab8bd7480f9205257d
SHA1 b46bbbb64b3df5322dd81613e7fa14426816b1c1
SHA256 445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b
SHA512 3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-02 05:45

Reported

2024-02-02 05:48

Platform

win11-20231215-en

Max time kernel

83s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StudioApp.exe C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StudioApp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\StudioApp.exe

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

C:\Users\Admin\AppData\Local\Temp\StudioApp.exe

"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 api.gofile.io udp
FR 151.80.29.83:443 api.gofile.io tcp
US 173.231.16.76:443 api.ipify.org tcp
US 206.168.191.31:443 store8.gofile.io tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 253.102.89.159.in-addr.arpa udp
US 173.231.16.76:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.133.233:443 discordapp.com tcp
FR 151.80.29.83:443 api.gofile.io tcp
US 206.168.191.31:443 store8.gofile.io tcp
US 173.231.16.76:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 173.231.16.76:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.133.233:443 discordapp.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI9562\python310.dll

MD5 40435110e96cf8bc9f52fa6e301f1f79
SHA1 d0588d44d4e0379039684670dd17a7b2a0622ae2
SHA256 b712d27f285dd2603d26418f56e5a4f81fe8d192286be0fc69b388d0f72421b3
SHA512 c2c9a86d92b05fd90e45749959c6141463cbaeba3bd4d4dac74aa41e649c2bbc8fb4232aa43de6273ca34ed84f42cd494253f2d36faaa5071b59f36c1f8c0707

C:\Users\Admin\AppData\Local\Temp\_MEI9562\python310.dll

MD5 0c491d5bf955e27c40bb650054f40267
SHA1 dc709ed2cb8defb71e0dfbc8fd67f45d27caa8f6
SHA256 06a98f4a76b408c95211bb8fcbdb20481f12d76aa7d0554d2f7bd5e81b952562
SHA512 04b0133254ccdc04bd555c5a8fabdaf4b4662228db30cdb36ca7fd8672f027b8b763c3f833b193a80b6db5a83eed222b9ee3a4d46592a886a884941fd605f015

C:\Users\Admin\AppData\Local\Temp\_MEI9562\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI9562\base_library.zip

MD5 1fc63ee2743a189af947de2dd055fdbc
SHA1 d4196a6af37f5de65307e351a0d46a1fa66ff773
SHA256 f3767f41ba1576ac4bea090ddbc9170074fe152531f8b2afe6d3cafd083aa914
SHA512 47ed7e4674397e442757c736687faa0b722504ff6874d3b106e7ef030ec909f29ce59df649b989de43698f6e23c589d9cb79828ca68bd4057baca12ac1264829

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ctypes.pyd

MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_lzma.pyd

MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_bz2.pyd

MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libssl-1_1.dll

MD5 e99ae793d3cc84fe215e842e9d1369ab
SHA1 2ae12d5f1272f6188f120c2fad697d1553cd0fc8
SHA256 9b193d058b46e4a61c2e159a7cfda05417f51eaf6fd35408ee9b268a25004333
SHA512 b2852043ac13d5ae2cd51105c3318bfa9a84b1cbf0ee1b399917cf4c107ba88ee82bae5f077a0c86834079b75837126ac09e96cbed11a2ea78e5fd3eae59e7dd

C:\Users\Admin\AppData\Local\Temp\_MEI9562\VCRUNTIME140_1.dll

MD5 bba9680bc310d8d25e97b12463196c92
SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_uuid.pyd

MD5 041556420bdb334a71765d33229e9945
SHA1 0122316e74ee4ada1ce1e0310b8dca1131972ce1
SHA256 8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6
SHA512 18da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ssl.pyd

MD5 9ddb64354ef0b91c6999a4b244a0a011
SHA1 86a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
SHA512 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_sqlite3.pyd

MD5 9f38f603bd8f7559609c4ffa47f23c86
SHA1 8b0136fc2506c1ccef2009db663e4e7006e23c92
SHA256 28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319
SHA512 273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_socket.pyd

MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_queue.pyd

MD5 52d0a6009d3de40f4fa6ec61db98c45c
SHA1 5083a2aff5bcce07c80409646347c63d2a87bd25
SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
SHA512 cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_overlapped.pyd

MD5 02c0f2eff280b9a92003786fded7c440
SHA1 5a7fe7ed605ff1c49036d001ae60305e309c5509
SHA256 f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
SHA512 2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_multiprocessing.pyd

MD5 62733ce8ae95241bf9ca69f38c977923
SHA1 e5c3f4809e85b331cc8c5ba0ae76979f2dfddf85
SHA256 af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa
SHA512 fdfbf5d74374f25ed5269cdbcdf8e643b31faa9c8205eac4c22671aa5debdce4052f1878f38e7fab43b85a44cb5665e750edce786caba172a2861a5eabfd8d49

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_hashlib.pyd

MD5 d856a545a960bf2dca1e2d9be32e5369
SHA1 67a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
SHA512 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_decimal.pyd

MD5 e4dd2af3b88be3d6ec80a07be0c12c14
SHA1 6c2ed484b730e08774fda69456d5dcba5306313b
SHA256 08b0898ffee5b4890324e81980431a04b25504c4591e206b68c7b7a00a9b6031
SHA512 227dbd7f56d6c2a6157266eafa76d60e964aaa6b7f8ddb6a255640389f09dd1b187f17030e6a4d1017250f94cf05299b70da881522d0e7f6432d00e66e2a6ada

C:\Users\Admin\AppData\Local\Temp\_MEI9562\select.pyd

MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_cffi_backend.cp310-win_amd64.pyd

MD5 ebb660902937073ec9695ce08900b13d
SHA1 881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA512 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_asyncio.pyd

MD5 4543813a21958d0764975032b09ded7b
SHA1 c571dea89ab89b6aab6da9b88afe78ace90dd882
SHA256 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
SHA512 3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

C:\Users\Admin\AppData\Local\Temp\_MEI9562\unicodedata.pyd

MD5 3d0c6161f7134ec00fc3636d814d1e79
SHA1 0f54903140b1a37aa1d8e4e599ce18775236747b
SHA256 e018bd149dd6f3d216e503e3fff09642bb804f80673487e6f6bbf2904d13756c
SHA512 084be959f70c7434708d163150ce958194b9235f147a1bc6cb16f830b71f72f5521b11b1c49af2438c95f69368e071b1149e08da8bc5c8f1b55c39827273b5ca

C:\Users\Admin\AppData\Local\Temp\_MEI9562\sqlite3.dll

MD5 c6ab53459da5b364cf675a91f7c03a21
SHA1 afa914ca4963d5920164e4ec0d2a83973a7a622c
SHA256 6c361a3860c3bfe7983046eca39b68a7107a3f587a094e9df31850abe6e3b1a2
SHA512 8d1c804f12f458a7965db2bc23ad79ece3760325a13765b43bfcbe564522f9508a19f550b892627178fe4fbc68c462903bde6b84cf400095ae318506f0ef91cd

C:\Users\Admin\AppData\Local\Temp\_MEI9562\pyexpat.pyd

MD5 43e5a1470c298ba773ac9fcf5d99e8f9
SHA1 06db03daf3194c9e492b2f406b38ed33a8c87ab3
SHA256 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65
SHA512 a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pywintypes310.dll

MD5 ceb06a956b276cea73098d145fa64712
SHA1 6f0ba21f0325acc7cf6bf9f099d9a86470a786bf
SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
SHA512 05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pywintypes310.dll

MD5 96a56fd7a540a3ab8e96b4a928386c4c
SHA1 9ea86f569181cd8d231cf284130aba36ec56d8c3
SHA256 43ccba753a203a3e0a9beb6e9c32ee152bd13a674cc7cb58fac20dbdfd53262a
SHA512 2cbeff88a12d10a4ff9d10085a827f7c6b8251fc15034ef6a834dce8701847dda3f54fa0ad55dcf568bb7f60b1ee03b625726a7b2fec86a05bf487fab77803f8

C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pythoncom310.dll

MD5 460038132446b9490563ea233430f575
SHA1 62eb993f4cc15f404a48c36ace73a8688c4c5b5d
SHA256 6633082772e0a3cb22ec6a6975a85621bffdcc2538881555e0ba06d0e128c73e
SHA512 6fe13a58cf7d3078e8d1e86d325898b1f6a95ea4c7ac10f9efd0a2aea95709b0f0c4aa021fae81fe7387f6966a664885efd048724ff242d3b39414a810d1aae7

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll

MD5 855b92a5fc8d0d890a152c52e4904e86
SHA1 eaa322dbc841f85de04698a7d2ca291da11a1ee5
SHA256 865ca60b5a918c077d987feb24c90925ad372469e8b490ef4368af1b3c3bb27d
SHA512 2c7206146685fc29452b6b746dcee6651e4f01a062a5d444ab6c250eb1ceb8f498bbb0227c339d25ca6e097e77222cb926bde0a97f8bad9d2cf697c7ec9bc385

C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pythoncom310.dll

MD5 6681f4398fc070c75d94514291ebce81
SHA1 1d24ed01e2da82585d231c0b7d8b5af0f526ae2c
SHA256 e6ca1f60c59915724d57ca9e6967430227a35138bb428389aa25c270b94c967b
SHA512 e2c39e657ed94d713e728cc11d47b7a206439b4b87c1cea46789d9c5f432e912a967f1698e9eb450cf43180d4c8191ff302d707fb924eae70354adc9911c5b55

C:\Users\Admin\AppData\Local\Temp\_MEI9562\win32\win32api.pyd

MD5 00e5da545c6a4979a6577f8f091e85e1
SHA1 a31a2c85e272234584dacf36f405d102d9c43c05
SHA256 ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee
SHA512 9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31

C:\Users\Admin\AppData\Local\Temp\_MEI9562\win32\win32api.pyd

MD5 13bd5a8fc0756c26aec7c58a1d2854e2
SHA1 64cb5fa2654201eb08954bdb23604dfdddb5741f
SHA256 03493b2f476c2d0bfec64454c194ac9c5b807a3b33b7fd08441a7cf5a2700397
SHA512 9aaefc2dee927554f12c44d65bdae2f64c99e7938427476f84fe6cf16290752d566b7b4ad8ae5bbc1510e7d8927a0725c25170a8b35b01dea06e4e619d900831

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libssl-1_1.dll

MD5 a92cd7aa09656ec9911f405c049fb8c2
SHA1 8e43ab9860fedc5c7a6aee69ec58887ae278be2f
SHA256 ee949a02fb9a2f5bd7eab3597db91ff248cbba41a3088388728e8b9bb7e2d4d8
SHA512 566bf8989c3c15d5ad235323f433e7d3ddceecc186c980c51f486a90ee45004b9c536199cc660c8f1c397def91bbd06fc483a9a5961b06712450e838737e489f

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll

MD5 8af0d5caec14d8a8b7444dbce52793ab
SHA1 17fd54f5d7f48d14db7000f44698e264dc4a46b5
SHA256 f4cbd25a9e427d95d4b879c6fef7020e51a658ce72e424a7210fa2e025ea59c6
SHA512 e991bcd656e2cd1ef2acf4b086ba13a5d2a6c524bfd8f34c2a996b67b2881fb13f95a9be499ff6fdc52cccdae7acf7de1b9156943209f75e561554751f044bfa

C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll

MD5 8b650450c6834c7d73d3f33caa2e28eb
SHA1 7b34a46586eb68cf4cc24c42264882062c017a41
SHA256 1513175281f9e13800e70169a34f0afd195e0aa355e4d9b82ef93469f3ae9f61
SHA512 4b87ae1bb1dcb12ef423f1ff2221ce6d1c237074c3a369e3c97178228bb8f86fc94903242cbb35c62a36f1ff8dc2b449318572341c11fea3380eedce0854a562

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ssl.pyd

MD5 f99ea52fe6f5ad8d1d8ab6585c71658e
SHA1 8446d767763cf4b5f72de48d8dea1f2b20946753
SHA256 01a9182bfd0b3ef1d52bfc6468d52f8bb198fe51d4d5b2029ecdbd6de4225fe0
SHA512 a5ac86e576b598182e5ea6cb0f66e8b5405d12b8da02060fe35ac2b78d15762414dd0fe68fb24b46cd16289f54e81a2095b1ca7214939e8231e5723cc620b86b

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_sqlite3.pyd

MD5 96e7279614eabe3a1d069315770cd23e
SHA1 392452eed4b6e51b88b4fe35bf02e87fe5fb0081
SHA256 0e1ba22a036554223bd9bd0f72e4bf9979ce84b42c75256a717b883ef207e60f
SHA512 6df8d9a5a4dc815dfc68c669fa8334b40fdd09168e8474fcea2864c5bf562cb88b16c03b5b6140ecbbc970c9c6f01490f579b71427cab1bcfee67accc0697b19

C:\Users\Admin\AppData\Local\Temp\_MEI9562\_asyncio.pyd

MD5 4469c971878663785b4636664cf08e1a
SHA1 9bed4aef86721b413cc9f21bcd4e1fdfb8603ea7
SHA256 6d6a4db772904281efb3f275a30426c617893ec6c5bd693ec7f28942d3469017
SHA512 164c189a2c150592580b2a5fc4fce2c0f4fad2145432845abc12ebd1b61ef9e74bb1ea0fa679cd54218c4a137a54b70c5f112d9df91d3fb4217e82e97c0af218

C:\Users\Admin\AppData\Local\Temp\_MEI9562\sqlite3.dll

MD5 c976a752bc438e9af8ec4110c097e665
SHA1 89d2979be5f06c0449b139d93749d6752a8f3cbb
SHA256 f3751b2e6cb873e07059af7617f4acba8bb9490078c8873e9b0939ee982f6e97
SHA512 b853c27b395a21ab56b97eecf39fec52e0bf67b682438ffc65a8a7a65fa9862daf8f0125c58e7bd91876ec1ae9117c75ccc67daf9ee92dd0a55e0c122c6a5a03

C:\Users\Admin\AppData\Local\Temp\_MEI9562\charset_normalizer\md.cp310-win_amd64.pyd

MD5 f33ca57d413e6b5313272fa54dbc8baa
SHA1 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
SHA512 f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

C:\Users\Admin\AppData\Local\Temp\_MEI9562\unicodedata.pyd

MD5 e17b0c3854f922aa9d3d69c1c071aa76
SHA1 07b887b43df9ee7053fd518c00c034cca6d40151
SHA256 a819290f80ee9f0b976dc57e7042a5742de39fa1eb167e5ad50f959ef8a403b8
SHA512 eebe9ea5fdf0609234d8e39d314804491e334fd91a58869e054ca418dc0f6750be2b8b71201600ada90f2c9910f66213c8c049a2336cbd22a9af960966cb99e1

C:\Users\Admin\AppData\Local\Temp\_MEI9562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

MD5 494f5b9adc1cfb7fdb919c9b1af346e1
SHA1 4a5fddd47812d19948585390f76d5435c4220e6b
SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
SHA512 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_ecb.pyd

MD5 dedae3efda452bab95f69cae7aebb409
SHA1 520f3d02693d7013ea60d51a605212efed9ca46b
SHA256 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a
SHA512 8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c

C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_cbc.pyd

MD5 0c46d7b7cd00b3d474417de5d6229c41
SHA1 825bdb1ea8bbfe7de69487b76abb36196b5fdac0
SHA256 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1
SHA512 d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864

C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_cfb.pyd

MD5 3142c93a6d9393f071ab489478e16b86
SHA1 4fe99c817ed3bcc7708a6631f100862ebda2b33d
SHA256 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586
SHA512 dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef

C:\Users\Admin\AppData\Local\Temp\crcook.txt

MD5 155ea3c94a04ceab8bd7480f9205257d
SHA1 b46bbbb64b3df5322dd81613e7fa14426816b1c1
SHA256 445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b
SHA512 3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05

Analysis: behavioral3

Detonation Overview

Submitted

2024-02-02 05:45

Reported

2024-02-02 05:48

Platform

win10v2004-20231215-en

Max time kernel

145s

Max time network

147s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-02-02 05:45

Reported

2024-02-02 05:48

Platform

win11-20231215-en

Max time kernel

87s

Max time network

94s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 52.111.227.14:443 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A