fb1814fb9c9f6031ec7fa4edcbab17fe010b2e8677e0cb08cfd874d5774ac956

Analysis

max time kernel
145s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vantage/dist/Vantage.exe
Size 7.0MB
Sample240222-xsp5saee37
SHA256 6f7302e11b1672c2cad6afc756c9fef2f6a00652f0e4d16ecaa299b2719a0825
MD5 6b1a2e15f99914d60128ef4d3ffd52ff
SHA1 c005ca60d17c8d024913bbc9b7f3bb8052946c04
SHA512 0d7e50a4b5d83e6c7afce5254b6dfe2ec2198f6938489b1fca3465916912328d41a212597224ab6cfb4431ec500a9fd36d184e2dd29aa5b73066c9e83fd2e66f
SSDEEP 196608:6zug1W903eV4QFMToEuGxgh858F0ibfUxgABKbk9At8:KW+eGQFMTozGxu8C0ibftS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
572	Vantage.exe
572	Vantage.exe
572	Vantage.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 572	1200	Vantage.exe	82
PID 1200 wrote to memory of 572	1200	Vantage.exe	82

C:\Users\Admin\AppData\Local\Temp\Vantage\dist\Vantage.exe
"C:\Users\Admin\AppData\Local\Temp\Vantage\dist\Vantage.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\Vantage\dist\Vantage.exe
  "C:\Users\Admin\AppData\Local\Temp\Vantage\dist\Vantage.exe"
  2⤵
  - Loads dropped DLL
  PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\_decimal.pyd
Size 247KB
SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
MD5 f78f9855d2a7ca940b6be51d68b80bf2
SHA1 fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA512 6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
SSDEEP 6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\base_library.zip
Size 1.3MB
SHA256 eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
MD5 ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1 f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA512 4f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1d1YgCCaYcet:uttcY+UHCiCAd+cqHdmmPHzqEaYcet
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\python312.dll
Size 6.7MB
SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
MD5 48ebfefa21b480a9b0dbfc3364e1d066
SHA1 b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA512 4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
SSDEEP 98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12002\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads