Analysis Overview
SHA256
22442d487765e55be893d7b769b48bdcc193d537aada4435954d6cbdb0563d86
Threat Level: Known bad
The file StudioApp.exe was found to be: Known bad.
Malicious Activity Summary
An infostealer written in Python and packaged with PyInstaller.
Crealstealer family
Reads user/profile data of web browsers
Loads dropped DLL
Drops startup file
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Detects Pyinstaller
Unsigned PE
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Modifies registry class
Enumerates processes with tasklist
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-02 05:45
Signatures
An infostealer written in Python and packaged with PyInstaller.
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Crealstealer family
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-02 05:45
Reported
2024-02-02 05:48
Platform
win10v2004-20231215-en
Max time kernel
90s
Max time network
92s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3272 wrote to memory of 4896 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe |
| PID 3272 wrote to memory of 4896 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe |
| PID 4896 wrote to memory of 860 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 4896 wrote to memory of 860 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 4896 wrote to memory of 4080 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 4896 wrote to memory of 4080 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 4080 wrote to memory of 4984 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\tasklist.exe |
| PID 4080 wrote to memory of 4984 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\tasklist.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| US | 104.237.62.212:443 | api.ipify.org | tcp |
| FR | 51.38.43.18:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | store8.gofile.io | udp |
| US | 206.168.191.31:443 | store8.gofile.io | tcp |
| US | 8.8.8.8:53 | geolocation-db.com | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.43.38.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.62.237.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.191.168.206.in-addr.arpa | udp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 8.8.8.8:53 | discordapp.com | udp |
| US | 162.159.135.233:443 | discordapp.com | tcp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 253.102.89.159.in-addr.arpa | udp |
| US | 104.237.62.212:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.135.233:443 | discordapp.com | tcp |
| FR | 51.38.43.18:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | store10.gofile.io | udp |
| FR | 31.14.70.252:443 | store10.gofile.io | tcp |
| US | 104.237.62.212:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 8.8.8.8:53 | 252.70.14.31.in-addr.arpa | udp |
| US | 162.159.135.233:443 | discordapp.com | tcp |
| US | 104.237.62.212:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.135.233:443 | discordapp.com | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI32722\python310.dll
| MD5 | 1a5ced04216e75b8692d002a9e618137 |
| SHA1 | 1bea26a764268a22a6fcdf27b0bb24dce65b0c17 |
| SHA256 | 79861acd0beb7c64ad8bec2471a0aaaf2810de637e41405e0b9b98236977bb0a |
| SHA512 | 0418c6044a2312f8e5da9b867d877cf2a1971ab39308d54648bd03c3578dec3ee43e30a2f6cc17ab29c120650ce4031ffd89cf40bf09112faf5a404a38ef5b6f |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\python310.dll
| MD5 | 3c272531eb4914fc79c138b3c819aafb |
| SHA1 | d640421e0df04d077583421138a7a2ca81f66b8c |
| SHA256 | eee604d01134a811fe24e128ae83941e797254a974f0e0a4b4581b800702d9c0 |
| SHA512 | f4f7f721fc76b85f3bcdc1c0dba9b462de76e8779ecf27bd02d6a7451a7a5dd3fa1fa4d0aad4032f7c50bd4d8f464b38a489bb6a81119f10bafcf7e81cfe7a39 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\base_library.zip
| MD5 | 24822808dd7b4cac7e8a79e070e7e636 |
| SHA1 | 26bd628a3bf26adf357547aea9525d5ecddfdce5 |
| SHA256 | a63aac4d7d17736b16d41a6bd9945c933233a193caea2c64c01e128355a118e9 |
| SHA512 | c6d113223e6cb2b1bb17c37564cc3f01247b944baa994c9352bb1f024d24c1dd77cefd32469e6bca6a6b503edf521d1b679b0812e235879f3ca3bc0feb058a5b |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_ctypes.pyd
| MD5 | ca4cef051737b0e4e56b7d597238df94 |
| SHA1 | 583df3f7ecade0252fdff608eb969439956f5c4a |
| SHA256 | e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b |
| SHA512 | 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_bz2.pyd
| MD5 | bbe89cf70b64f38c67b7bf23c0ea8a48 |
| SHA1 | 44577016e9c7b463a79b966b67c3ecc868957470 |
| SHA256 | 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723 |
| SHA512 | 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_sqlite3.pyd
| MD5 | 9f38f603bd8f7559609c4ffa47f23c86 |
| SHA1 | 8b0136fc2506c1ccef2009db663e4e7006e23c92 |
| SHA256 | 28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319 |
| SHA512 | 273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\select.pyd
| MD5 | c119811a40667dca93dfe6faa418f47a |
| SHA1 | 113e792b7dcec4366fc273e80b1fc404c309074c |
| SHA256 | 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7 |
| SHA512 | 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\pyexpat.pyd
| MD5 | 43e5a1470c298ba773ac9fcf5d99e8f9 |
| SHA1 | 06db03daf3194c9e492b2f406b38ed33a8c87ab3 |
| SHA256 | 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65 |
| SHA512 | a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pywintypes310.dll
| MD5 | ceb06a956b276cea73098d145fa64712 |
| SHA1 | 6f0ba21f0325acc7cf6bf9f099d9a86470a786bf |
| SHA256 | c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005 |
| SHA512 | 05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pythoncom310.dll
| MD5 | 583df8d3cf13e94465e22a423c7b13a5 |
| SHA1 | 85d72221a5c02b6eff531fac69935f8964d8896b |
| SHA256 | 878f48a9b2c2e51d6ab9468b14bba76069ffc384322c2f8fd73aaf6b08545875 |
| SHA512 | 2f6cd60693614acd6d8af86638243d2e38551b815f20ccc335ba61e501494cfa214164a1d454a5f816468bd51ce6ced70437d76a8ae3228415d2e46e935f64d2 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\pywin32_system32\pythoncom310.dll
| MD5 | 0f44f94f8285b64e39162238a1329b27 |
| SHA1 | 251cfa149af0d74586877db9c4436424db00c9f5 |
| SHA256 | 317429c5c908b013003bf4ca4419ef563f3faaf7f78492a4e3f2a5df54ef4598 |
| SHA512 | 3330499d0f8881b13b8f3790927d2a1ac9935dd8f7880275c0de6514d4e603f3219295bc91863706d55da210619c55682b13c3f7600fe16508c823eb3daf7982 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\win32\win32api.pyd
| MD5 | 00e5da545c6a4979a6577f8f091e85e1 |
| SHA1 | a31a2c85e272234584dacf36f405d102d9c43c05 |
| SHA256 | ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee |
| SHA512 | 9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_ssl.pyd
| MD5 | 9ddb64354ef0b91c6999a4b244a0a011 |
| SHA1 | 86a9dc5ea931638699eb6d8d03355ad7992d2fee |
| SHA256 | e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab |
| SHA512 | 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\libssl-1_1.dll
| MD5 | 8769adafca3a6fc6ef26f01fd31afa84 |
| SHA1 | 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6 |
| SHA256 | 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071 |
| SHA512 | fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_hashlib.pyd
| MD5 | d856a545a960bf2dca1e2d9be32e5369 |
| SHA1 | 67a15ecf763cdc2c2aa458a521db8a48d816d91e |
| SHA256 | cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3 |
| SHA512 | 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\unicodedata.pyd
| MD5 | 1664cbe7200b4214e7d7c43e11249693 |
| SHA1 | c74f29ff037d5252014fc52e33a28e005299c2bd |
| SHA256 | 3a57d912ae0bfa52dea621c49b48eb3a461dd3112527705ac0216782bdb9860c |
| SHA512 | 2ca0c24a7c6256a3dafcc267669d52493e62b7ae3fae94f229a018564cfa16308e3d78a7daa67abe0c3d37709a3e6879414bc943a6ec39f0c11bc24f1ffbeb10 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
| MD5 | 494f5b9adc1cfb7fdb919c9b1af346e1 |
| SHA1 | 4a5fddd47812d19948585390f76d5435c4220e6b |
| SHA256 | ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051 |
| SHA512 | 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_cffi_backend.cp310-win_amd64.pyd
| MD5 | ebb660902937073ec9695ce08900b13d |
| SHA1 | 881537acead160e63fe6ba8f2316a2fbbb5cb311 |
| SHA256 | 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd |
| SHA512 | 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_ecb.pyd
| MD5 | dedae3efda452bab95f69cae7aebb409 |
| SHA1 | 520f3d02693d7013ea60d51a605212efed9ca46b |
| SHA256 | 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a |
| SHA512 | 8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\charset_normalizer\md.cp310-win_amd64.pyd
| MD5 | f33ca57d413e6b5313272fa54dbc8baa |
| SHA1 | 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44 |
| SHA256 | 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664 |
| SHA512 | f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_uuid.pyd
| MD5 | 041556420bdb334a71765d33229e9945 |
| SHA1 | 0122316e74ee4ada1ce1e0310b8dca1131972ce1 |
| SHA256 | 8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6 |
| SHA512 | 18da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_cfb.pyd
| MD5 | 3142c93a6d9393f071ab489478e16b86 |
| SHA1 | 4fe99c817ed3bcc7708a6631f100862ebda2b33d |
| SHA256 | 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586 |
| SHA512 | dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\Crypto\Cipher\_raw_cbc.pyd
| MD5 | 0c46d7b7cd00b3d474417de5d6229c41 |
| SHA1 | 825bdb1ea8bbfe7de69487b76abb36196b5fdac0 |
| SHA256 | 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1 |
| SHA512 | d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\sqlite3.dll
| MD5 | 7da2e34f51395618a9eefa40614a8edd |
| SHA1 | 0b7be3a9ea1232611601c545afad10a936ccea23 |
| SHA256 | f7a2c99d75ca0778d26c62981888756e2b7415e8cfc2f837bdc4b885022329bc |
| SHA512 | b8d82291eda5250e0af1c356005a7a17b8bd98bd4f3e8863c03b34769a3e74b181f4eacaf5425d374a771cd25a506f3c0ace37ce61be4641148d6aeb73835dd2 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_overlapped.pyd
| MD5 | 02c0f2eff280b9a92003786fded7c440 |
| SHA1 | 5a7fe7ed605ff1c49036d001ae60305e309c5509 |
| SHA256 | f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973 |
| SHA512 | 2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_asyncio.pyd
| MD5 | 4543813a21958d0764975032b09ded7b |
| SHA1 | c571dea89ab89b6aab6da9b88afe78ace90dd882 |
| SHA256 | 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5 |
| SHA512 | 3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll
| MD5 | b06e0b2098b1eedc5a9d439f3a43efd9 |
| SHA1 | ef17feeddffb86ee84e4298b17c6747d280c8eb3 |
| SHA256 | 7cf125863b3f3bf4e067a1b7570d7f4dce0379e8675ab202e9a96f6ec35a92c8 |
| SHA512 | 55bd7b9ca65521b8fdc5e36ba115db1b8e1582e097ab877ac8d25113672d1ee1babcd62013c4b475b9612dac674eca754678afbe4210f649b5b610bcc83b14e2 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll
| MD5 | 341ed5595c40259348521c0b765f4472 |
| SHA1 | 009ef20bdbe681e82e61188c52a58e462cf08e16 |
| SHA256 | fcbaea90ea214e865b6da4815b7c3eda371be603afd50b7b585e7bb54388e7ef |
| SHA512 | 7e2c91e04420f01981d7927507ae2886c6ca6f3b75e177a0c4aa295614c4e04f3155af3b5737e07f71ca4d3f1d99efe64639cbeef149aea5f0e3e8efdf11339b |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\VCRUNTIME140_1.dll
| MD5 | bba9680bc310d8d25e97b12463196c92 |
| SHA1 | 9a480c0cf9d377a4caedd4ea60e90fa79001f03a |
| SHA256 | e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab |
| SHA512 | 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_queue.pyd
| MD5 | 52d0a6009d3de40f4fa6ec61db98c45c |
| SHA1 | 5083a2aff5bcce07c80409646347c63d2a87bd25 |
| SHA256 | 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75 |
| SHA512 | cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_socket.pyd
| MD5 | 0f5e64e33f4d328ef11357635707d154 |
| SHA1 | 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e |
| SHA256 | 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe |
| SHA512 | 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_multiprocessing.pyd
| MD5 | 62733ce8ae95241bf9ca69f38c977923 |
| SHA1 | e5c3f4809e85b331cc8c5ba0ae76979f2dfddf85 |
| SHA256 | af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa |
| SHA512 | fdfbf5d74374f25ed5269cdbcdf8e643b31faa9c8205eac4c22671aa5debdce4052f1878f38e7fab43b85a44cb5665e750edce786caba172a2861a5eabfd8d49 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_decimal.pyd
| MD5 | 6339fa92584252c3b24e4cce9d73ef50 |
| SHA1 | dccda9b641125b16e56c5b1530f3d04e302325cd |
| SHA256 | 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96 |
| SHA512 | 428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\unicodedata.pyd
| MD5 | 4c8af8a30813e9380f5f54309325d6b8 |
| SHA1 | 169a80d8923fb28f89bc26ebf89ffe37f8545c88 |
| SHA256 | 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05 |
| SHA512 | ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\sqlite3.dll
| MD5 | aaf9fd98bc2161ad7dff996450173a3b |
| SHA1 | ab634c09b60aa18ea165084a042d917b65d1fe85 |
| SHA256 | f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592 |
| SHA512 | 597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-1_1.dll
| MD5 | 4fb97104f053555c648a19de3a03822c |
| SHA1 | c632f971190d00e6dd7df5ae0ea05508696c01cb |
| SHA256 | 44d0b403323eab1d2e4a3217e84636061a0ebca222563b2588a281feb3e8e0b3 |
| SHA512 | c439fc1254f28d167577fb7d56dfc0796262507ef9c1a41ecae1d44bbf853765b891263d2edcb462d48fa239c814c43183d272865b9091469a572018d6d43585 |
C:\Users\Admin\AppData\Local\Temp\_MEI32722\_lzma.pyd
| MD5 | 0a94c9f3d7728cf96326db3ab3646d40 |
| SHA1 | 8081df1dca4a8520604e134672c4be79eb202d14 |
| SHA256 | 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31 |
| SHA512 | 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087 |
C:\Users\Admin\AppData\Local\Temp\crcook.txt
| MD5 | 155ea3c94a04ceab8bd7480f9205257d |
| SHA1 | b46bbbb64b3df5322dd81613e7fa14426816b1c1 |
| SHA256 | 445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b |
| SHA512 | 3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-02-02 05:45
Reported
2024-02-02 05:48
Platform
win11-20231215-en
Max time kernel
83s
Max time network
99s
Command Line
Signatures
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 956 wrote to memory of 3536 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe |
| PID 956 wrote to memory of 3536 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe |
| PID 3536 wrote to memory of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 3536 wrote to memory of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 3536 wrote to memory of 4148 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 3536 wrote to memory of 4148 | N/A | C:\Users\Admin\AppData\Local\Temp\StudioApp.exe | C:\Windows\system32\cmd.exe |
| PID 4148 wrote to memory of 1000 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\tasklist.exe |
| PID 4148 wrote to memory of 1000 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\tasklist.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| FR | 151.80.29.83:443 | api.gofile.io | tcp |
| US | 173.231.16.76:443 | api.ipify.org | tcp |
| US | 206.168.191.31:443 | store8.gofile.io | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.133.233:443 | discordapp.com | tcp |
| US | 8.8.8.8:53 | 253.102.89.159.in-addr.arpa | udp |
| US | 173.231.16.76:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.133.233:443 | discordapp.com | tcp |
| FR | 151.80.29.83:443 | api.gofile.io | tcp |
| US | 206.168.191.31:443 | store8.gofile.io | tcp |
| US | 173.231.16.76:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.133.233:443 | discordapp.com | tcp |
| US | 173.231.16.76:443 | api.ipify.org | tcp |
| DE | 159.89.102.253:443 | geolocation-db.com | tcp |
| US | 162.159.133.233:443 | discordapp.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI9562\python310.dll
| MD5 | 40435110e96cf8bc9f52fa6e301f1f79 |
| SHA1 | d0588d44d4e0379039684670dd17a7b2a0622ae2 |
| SHA256 | b712d27f285dd2603d26418f56e5a4f81fe8d192286be0fc69b388d0f72421b3 |
| SHA512 | c2c9a86d92b05fd90e45749959c6141463cbaeba3bd4d4dac74aa41e649c2bbc8fb4232aa43de6273ca34ed84f42cd494253f2d36faaa5071b59f36c1f8c0707 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\python310.dll
| MD5 | 0c491d5bf955e27c40bb650054f40267 |
| SHA1 | dc709ed2cb8defb71e0dfbc8fd67f45d27caa8f6 |
| SHA256 | 06a98f4a76b408c95211bb8fcbdb20481f12d76aa7d0554d2f7bd5e81b952562 |
| SHA512 | 04b0133254ccdc04bd555c5a8fabdaf4b4662228db30cdb36ca7fd8672f027b8b763c3f833b193a80b6db5a83eed222b9ee3a4d46592a886a884941fd605f015 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\base_library.zip
| MD5 | 1fc63ee2743a189af947de2dd055fdbc |
| SHA1 | d4196a6af37f5de65307e351a0d46a1fa66ff773 |
| SHA256 | f3767f41ba1576ac4bea090ddbc9170074fe152531f8b2afe6d3cafd083aa914 |
| SHA512 | 47ed7e4674397e442757c736687faa0b722504ff6874d3b106e7ef030ec909f29ce59df649b989de43698f6e23c589d9cb79828ca68bd4057baca12ac1264829 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ctypes.pyd
| MD5 | ca4cef051737b0e4e56b7d597238df94 |
| SHA1 | 583df3f7ecade0252fdff608eb969439956f5c4a |
| SHA256 | e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b |
| SHA512 | 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_lzma.pyd
| MD5 | 0a94c9f3d7728cf96326db3ab3646d40 |
| SHA1 | 8081df1dca4a8520604e134672c4be79eb202d14 |
| SHA256 | 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31 |
| SHA512 | 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_bz2.pyd
| MD5 | bbe89cf70b64f38c67b7bf23c0ea8a48 |
| SHA1 | 44577016e9c7b463a79b966b67c3ecc868957470 |
| SHA256 | 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723 |
| SHA512 | 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libssl-1_1.dll
| MD5 | e99ae793d3cc84fe215e842e9d1369ab |
| SHA1 | 2ae12d5f1272f6188f120c2fad697d1553cd0fc8 |
| SHA256 | 9b193d058b46e4a61c2e159a7cfda05417f51eaf6fd35408ee9b268a25004333 |
| SHA512 | b2852043ac13d5ae2cd51105c3318bfa9a84b1cbf0ee1b399917cf4c107ba88ee82bae5f077a0c86834079b75837126ac09e96cbed11a2ea78e5fd3eae59e7dd |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\VCRUNTIME140_1.dll
| MD5 | bba9680bc310d8d25e97b12463196c92 |
| SHA1 | 9a480c0cf9d377a4caedd4ea60e90fa79001f03a |
| SHA256 | e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab |
| SHA512 | 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_uuid.pyd
| MD5 | 041556420bdb334a71765d33229e9945 |
| SHA1 | 0122316e74ee4ada1ce1e0310b8dca1131972ce1 |
| SHA256 | 8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6 |
| SHA512 | 18da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ssl.pyd
| MD5 | 9ddb64354ef0b91c6999a4b244a0a011 |
| SHA1 | 86a9dc5ea931638699eb6d8d03355ad7992d2fee |
| SHA256 | e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab |
| SHA512 | 4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_sqlite3.pyd
| MD5 | 9f38f603bd8f7559609c4ffa47f23c86 |
| SHA1 | 8b0136fc2506c1ccef2009db663e4e7006e23c92 |
| SHA256 | 28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319 |
| SHA512 | 273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_socket.pyd
| MD5 | 0f5e64e33f4d328ef11357635707d154 |
| SHA1 | 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e |
| SHA256 | 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe |
| SHA512 | 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_queue.pyd
| MD5 | 52d0a6009d3de40f4fa6ec61db98c45c |
| SHA1 | 5083a2aff5bcce07c80409646347c63d2a87bd25 |
| SHA256 | 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75 |
| SHA512 | cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_overlapped.pyd
| MD5 | 02c0f2eff280b9a92003786fded7c440 |
| SHA1 | 5a7fe7ed605ff1c49036d001ae60305e309c5509 |
| SHA256 | f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973 |
| SHA512 | 2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_multiprocessing.pyd
| MD5 | 62733ce8ae95241bf9ca69f38c977923 |
| SHA1 | e5c3f4809e85b331cc8c5ba0ae76979f2dfddf85 |
| SHA256 | af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa |
| SHA512 | fdfbf5d74374f25ed5269cdbcdf8e643b31faa9c8205eac4c22671aa5debdce4052f1878f38e7fab43b85a44cb5665e750edce786caba172a2861a5eabfd8d49 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_hashlib.pyd
| MD5 | d856a545a960bf2dca1e2d9be32e5369 |
| SHA1 | 67a15ecf763cdc2c2aa458a521db8a48d816d91e |
| SHA256 | cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3 |
| SHA512 | 34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_decimal.pyd
| MD5 | e4dd2af3b88be3d6ec80a07be0c12c14 |
| SHA1 | 6c2ed484b730e08774fda69456d5dcba5306313b |
| SHA256 | 08b0898ffee5b4890324e81980431a04b25504c4591e206b68c7b7a00a9b6031 |
| SHA512 | 227dbd7f56d6c2a6157266eafa76d60e964aaa6b7f8ddb6a255640389f09dd1b187f17030e6a4d1017250f94cf05299b70da881522d0e7f6432d00e66e2a6ada |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\select.pyd
| MD5 | c119811a40667dca93dfe6faa418f47a |
| SHA1 | 113e792b7dcec4366fc273e80b1fc404c309074c |
| SHA256 | 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7 |
| SHA512 | 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_cffi_backend.cp310-win_amd64.pyd
| MD5 | ebb660902937073ec9695ce08900b13d |
| SHA1 | 881537acead160e63fe6ba8f2316a2fbbb5cb311 |
| SHA256 | 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd |
| SHA512 | 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_asyncio.pyd
| MD5 | 4543813a21958d0764975032b09ded7b |
| SHA1 | c571dea89ab89b6aab6da9b88afe78ace90dd882 |
| SHA256 | 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5 |
| SHA512 | 3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\unicodedata.pyd
| MD5 | 3d0c6161f7134ec00fc3636d814d1e79 |
| SHA1 | 0f54903140b1a37aa1d8e4e599ce18775236747b |
| SHA256 | e018bd149dd6f3d216e503e3fff09642bb804f80673487e6f6bbf2904d13756c |
| SHA512 | 084be959f70c7434708d163150ce958194b9235f147a1bc6cb16f830b71f72f5521b11b1c49af2438c95f69368e071b1149e08da8bc5c8f1b55c39827273b5ca |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\sqlite3.dll
| MD5 | c6ab53459da5b364cf675a91f7c03a21 |
| SHA1 | afa914ca4963d5920164e4ec0d2a83973a7a622c |
| SHA256 | 6c361a3860c3bfe7983046eca39b68a7107a3f587a094e9df31850abe6e3b1a2 |
| SHA512 | 8d1c804f12f458a7965db2bc23ad79ece3760325a13765b43bfcbe564522f9508a19f550b892627178fe4fbc68c462903bde6b84cf400095ae318506f0ef91cd |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\pyexpat.pyd
| MD5 | 43e5a1470c298ba773ac9fcf5d99e8f9 |
| SHA1 | 06db03daf3194c9e492b2f406b38ed33a8c87ab3 |
| SHA256 | 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65 |
| SHA512 | a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pywintypes310.dll
| MD5 | ceb06a956b276cea73098d145fa64712 |
| SHA1 | 6f0ba21f0325acc7cf6bf9f099d9a86470a786bf |
| SHA256 | c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005 |
| SHA512 | 05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pywintypes310.dll
| MD5 | 96a56fd7a540a3ab8e96b4a928386c4c |
| SHA1 | 9ea86f569181cd8d231cf284130aba36ec56d8c3 |
| SHA256 | 43ccba753a203a3e0a9beb6e9c32ee152bd13a674cc7cb58fac20dbdfd53262a |
| SHA512 | 2cbeff88a12d10a4ff9d10085a827f7c6b8251fc15034ef6a834dce8701847dda3f54fa0ad55dcf568bb7f60b1ee03b625726a7b2fec86a05bf487fab77803f8 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pythoncom310.dll
| MD5 | 460038132446b9490563ea233430f575 |
| SHA1 | 62eb993f4cc15f404a48c36ace73a8688c4c5b5d |
| SHA256 | 6633082772e0a3cb22ec6a6975a85621bffdcc2538881555e0ba06d0e128c73e |
| SHA512 | 6fe13a58cf7d3078e8d1e86d325898b1f6a95ea4c7ac10f9efd0a2aea95709b0f0c4aa021fae81fe7387f6966a664885efd048724ff242d3b39414a810d1aae7 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll
| MD5 | 855b92a5fc8d0d890a152c52e4904e86 |
| SHA1 | eaa322dbc841f85de04698a7d2ca291da11a1ee5 |
| SHA256 | 865ca60b5a918c077d987feb24c90925ad372469e8b490ef4368af1b3c3bb27d |
| SHA512 | 2c7206146685fc29452b6b746dcee6651e4f01a062a5d444ab6c250eb1ceb8f498bbb0227c339d25ca6e097e77222cb926bde0a97f8bad9d2cf697c7ec9bc385 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\pywin32_system32\pythoncom310.dll
| MD5 | 6681f4398fc070c75d94514291ebce81 |
| SHA1 | 1d24ed01e2da82585d231c0b7d8b5af0f526ae2c |
| SHA256 | e6ca1f60c59915724d57ca9e6967430227a35138bb428389aa25c270b94c967b |
| SHA512 | e2c39e657ed94d713e728cc11d47b7a206439b4b87c1cea46789d9c5f432e912a967f1698e9eb450cf43180d4c8191ff302d707fb924eae70354adc9911c5b55 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\win32\win32api.pyd
| MD5 | 00e5da545c6a4979a6577f8f091e85e1 |
| SHA1 | a31a2c85e272234584dacf36f405d102d9c43c05 |
| SHA256 | ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee |
| SHA512 | 9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\win32\win32api.pyd
| MD5 | 13bd5a8fc0756c26aec7c58a1d2854e2 |
| SHA1 | 64cb5fa2654201eb08954bdb23604dfdddb5741f |
| SHA256 | 03493b2f476c2d0bfec64454c194ac9c5b807a3b33b7fd08441a7cf5a2700397 |
| SHA512 | 9aaefc2dee927554f12c44d65bdae2f64c99e7938427476f84fe6cf16290752d566b7b4ad8ae5bbc1510e7d8927a0725c25170a8b35b01dea06e4e619d900831 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libssl-1_1.dll
| MD5 | a92cd7aa09656ec9911f405c049fb8c2 |
| SHA1 | 8e43ab9860fedc5c7a6aee69ec58887ae278be2f |
| SHA256 | ee949a02fb9a2f5bd7eab3597db91ff248cbba41a3088388728e8b9bb7e2d4d8 |
| SHA512 | 566bf8989c3c15d5ad235323f433e7d3ddceecc186c980c51f486a90ee45004b9c536199cc660c8f1c397def91bbd06fc483a9a5961b06712450e838737e489f |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll
| MD5 | 8af0d5caec14d8a8b7444dbce52793ab |
| SHA1 | 17fd54f5d7f48d14db7000f44698e264dc4a46b5 |
| SHA256 | f4cbd25a9e427d95d4b879c6fef7020e51a658ce72e424a7210fa2e025ea59c6 |
| SHA512 | e991bcd656e2cd1ef2acf4b086ba13a5d2a6c524bfd8f34c2a996b67b2881fb13f95a9be499ff6fdc52cccdae7acf7de1b9156943209f75e561554751f044bfa |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\libcrypto-1_1.dll
| MD5 | 8b650450c6834c7d73d3f33caa2e28eb |
| SHA1 | 7b34a46586eb68cf4cc24c42264882062c017a41 |
| SHA256 | 1513175281f9e13800e70169a34f0afd195e0aa355e4d9b82ef93469f3ae9f61 |
| SHA512 | 4b87ae1bb1dcb12ef423f1ff2221ce6d1c237074c3a369e3c97178228bb8f86fc94903242cbb35c62a36f1ff8dc2b449318572341c11fea3380eedce0854a562 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_ssl.pyd
| MD5 | f99ea52fe6f5ad8d1d8ab6585c71658e |
| SHA1 | 8446d767763cf4b5f72de48d8dea1f2b20946753 |
| SHA256 | 01a9182bfd0b3ef1d52bfc6468d52f8bb198fe51d4d5b2029ecdbd6de4225fe0 |
| SHA512 | a5ac86e576b598182e5ea6cb0f66e8b5405d12b8da02060fe35ac2b78d15762414dd0fe68fb24b46cd16289f54e81a2095b1ca7214939e8231e5723cc620b86b |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_sqlite3.pyd
| MD5 | 96e7279614eabe3a1d069315770cd23e |
| SHA1 | 392452eed4b6e51b88b4fe35bf02e87fe5fb0081 |
| SHA256 | 0e1ba22a036554223bd9bd0f72e4bf9979ce84b42c75256a717b883ef207e60f |
| SHA512 | 6df8d9a5a4dc815dfc68c669fa8334b40fdd09168e8474fcea2864c5bf562cb88b16c03b5b6140ecbbc970c9c6f01490f579b71427cab1bcfee67accc0697b19 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\_asyncio.pyd
| MD5 | 4469c971878663785b4636664cf08e1a |
| SHA1 | 9bed4aef86721b413cc9f21bcd4e1fdfb8603ea7 |
| SHA256 | 6d6a4db772904281efb3f275a30426c617893ec6c5bd693ec7f28942d3469017 |
| SHA512 | 164c189a2c150592580b2a5fc4fce2c0f4fad2145432845abc12ebd1b61ef9e74bb1ea0fa679cd54218c4a137a54b70c5f112d9df91d3fb4217e82e97c0af218 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\sqlite3.dll
| MD5 | c976a752bc438e9af8ec4110c097e665 |
| SHA1 | 89d2979be5f06c0449b139d93749d6752a8f3cbb |
| SHA256 | f3751b2e6cb873e07059af7617f4acba8bb9490078c8873e9b0939ee982f6e97 |
| SHA512 | b853c27b395a21ab56b97eecf39fec52e0bf67b682438ffc65a8a7a65fa9862daf8f0125c58e7bd91876ec1ae9117c75ccc67daf9ee92dd0a55e0c122c6a5a03 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\charset_normalizer\md.cp310-win_amd64.pyd
| MD5 | f33ca57d413e6b5313272fa54dbc8baa |
| SHA1 | 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44 |
| SHA256 | 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664 |
| SHA512 | f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\unicodedata.pyd
| MD5 | e17b0c3854f922aa9d3d69c1c071aa76 |
| SHA1 | 07b887b43df9ee7053fd518c00c034cca6d40151 |
| SHA256 | a819290f80ee9f0b976dc57e7042a5742de39fa1eb167e5ad50f959ef8a403b8 |
| SHA512 | eebe9ea5fdf0609234d8e39d314804491e334fd91a58869e054ca418dc0f6750be2b8b71201600ada90f2c9910f66213c8c049a2336cbd22a9af960966cb99e1 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
| MD5 | 494f5b9adc1cfb7fdb919c9b1af346e1 |
| SHA1 | 4a5fddd47812d19948585390f76d5435c4220e6b |
| SHA256 | ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051 |
| SHA512 | 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_ecb.pyd
| MD5 | dedae3efda452bab95f69cae7aebb409 |
| SHA1 | 520f3d02693d7013ea60d51a605212efed9ca46b |
| SHA256 | 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a |
| SHA512 | 8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_cbc.pyd
| MD5 | 0c46d7b7cd00b3d474417de5d6229c41 |
| SHA1 | 825bdb1ea8bbfe7de69487b76abb36196b5fdac0 |
| SHA256 | 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1 |
| SHA512 | d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864 |
C:\Users\Admin\AppData\Local\Temp\_MEI9562\Crypto\Cipher\_raw_cfb.pyd
| MD5 | 3142c93a6d9393f071ab489478e16b86 |
| SHA1 | 4fe99c817ed3bcc7708a6631f100862ebda2b33d |
| SHA256 | 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586 |
| SHA512 | dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef |
C:\Users\Admin\AppData\Local\Temp\crcook.txt
| MD5 | 155ea3c94a04ceab8bd7480f9205257d |
| SHA1 | b46bbbb64b3df5322dd81613e7fa14426816b1c1 |
| SHA256 | 445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b |
| SHA512 | 3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-02-02 05:45
Reported
2024-02-02 05:48
Platform
win10v2004-20231215-en
Max time kernel
145s
Max time network
147s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 138.91.171.81:80 | tcp | |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-02-02 05:45
Reported
2024-02-02 05:48
Platform
win11-20231215-en
Max time kernel
87s
Max time network
94s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 52.111.227.14:443 | tcp | |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |