Analysis

  • max time kernel
    146s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 11:57

General

  • Target

    ExitLag-Crack-2024/ExitLag-Main/setup.bat

  • Size

    33B

  • MD5

    cecdbcd742db673b3e6baefb127401df

  • SHA1

    82ac4014b27094f5376b89f1ade998e5e8e297c0

  • SHA256

    680553b459d0e730ab9260109dfab454d34dbfcf1223cc70d6d1eefd1e578c8e

  • SHA512

    1d06a49c616b99cc7c7e19098a76cf07f8ec62cc7085d8dc6d4976e7c17e44e27d5df4c2c8421bc4242b6f46fba63b339b097fb5018a566bfe34b23070a24b2d

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 45 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\setup.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\ExitLag.exe
      "ExitLag.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Local\Temp\ExitLag-Crack-2024\ExitLag-Main\ExitLag.exe
        "ExitLag.exe"
        3⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
            PID:364
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3924
            • C:\Windows\system32\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4316

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\Crypto\Cipher\_raw_cbc.pyd

      Filesize

      22KB

      MD5

      0d0450292a5cf48171411cc8bfbbf0f7

      SHA1

      5de70c8bab7003bbd4fdcadb5c0736b9e6d0014c

      SHA256

      cb3ce4f65c9e18be6cbb504d79b594b51f38916e390dad73de4177fe88ce9c37

      SHA512

      ba6bbcc394e07fe09bb3a25e4aae9c4286516317d0b71d090b91aaec87fc10f61a4701aa45bc74cb216fff1e4ad881f62eb94d4ee2a3a9c8f04a954221b81d3a

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\Crypto\Cipher\_raw_cfb.pyd

      Filesize

      23KB

      MD5

      0f4d8993f0d2bd829fea19a1074e9ce7

      SHA1

      4dfe8107d09e4d725bb887dc146b612b19818abf

      SHA256

      6ca8711c8095bbc475d84f81fc8dfff7cd722ffe98e0c5430631ae067913a11f

      SHA512

      1e6f4bc9c682654bd18e1fc4bd26b1e3757c9f89dc5d0764b2e6c45db079af184875d7d3039161ea93d375e67f33e4fb48dcb63eae0c4ee3f98f1d2f7002b103

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\Crypto\Cipher\_raw_ctr.pyd

      Filesize

      25KB

      MD5

      8f385dbacd6c787926ab370c59d8bba2

      SHA1

      953bad3e9121577fab4187311cb473d237f6cba3

      SHA256

      ddf0b165c1c4eff98c4ac11e08c7beadcdd8cc76f495980a21df85ba4368762a

      SHA512

      973b80559f238f6b0a83cd00a2870e909a0d34b3df1e6bb4d47d09395c4503ea8112fb25115232c7658e5de360b258b6612373a96e6a23cde098b60fe5579c1c

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\Crypto\Cipher\_raw_ecb.pyd

      Filesize

      21KB

      MD5

      ade53f8427f55435a110f3b5379bdde1

      SHA1

      90bdafccfab8b47450f8226b675e6a85c5b4fcce

      SHA256

      55cf117455aa2059367d89e508f5e2ad459545f38d01e8e7b7b0484897408980

      SHA512

      2856d4c1bbdd8d37c419c5df917a9cc158c79d7f2ee68782c23fb615d719d8fe61aaa1b5f5207f80c31dc381cd6d8c9dabd450dbc0c774ff8e0a95337fda18bd

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\Crypto\Cipher\_raw_ofb.pyd

      Filesize

      22KB

      MD5

      b894480d74efb92a7820f0ec1fc70557

      SHA1

      07eaf9f40f4fce9babe04f537ff9a4287ec69176

      SHA256

      cdff737d7239fe4f39d76683d931c970a8550c27c3f7162574f2573aee755952

      SHA512

      498d31f040599fe3e4cfd9f586fc2fee7a056635e9c8fd995b418d6263d21f1708f891c60be09c08ccf01f7915e276aafb7abb84554280d11b25da4bdf3f3a75

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\VCRUNTIME140.dll

      Filesize

      95KB

      MD5

      f34eb034aa4a9735218686590cba2e8b

      SHA1

      2bc20acdcb201676b77a66fa7ec6b53fa2644713

      SHA256

      9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

      SHA512

      d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_asyncio.pyd

      Filesize

      63KB

      MD5

      33d0b6de555ddbbbd5ca229bfa91c329

      SHA1

      03034826675ac93267ce0bf0eaec9c8499e3fe17

      SHA256

      a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5

      SHA512

      dbbd1ddfa445e22a0170a628387fcf3cb95e6f8b09465d76595555c4a67da4274974ba7b348c4c81fe71c68d735c13aacb8063d3a964a8a0556fb000d68686b7

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_bz2.pyd

      Filesize

      81KB

      MD5

      86d1b2a9070cd7d52124126a357ff067

      SHA1

      18e30446fe51ced706f62c3544a8c8fdc08de503

      SHA256

      62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

      SHA512

      7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_cffi_backend.cp310-win_amd64.pyd

      Filesize

      177KB

      MD5

      ebb660902937073ec9695ce08900b13d

      SHA1

      881537acead160e63fe6ba8f2316a2fbbb5cb311

      SHA256

      52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

      SHA512

      19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_ctypes.pyd

      Filesize

      120KB

      MD5

      1635a0c5a72df5ae64072cbb0065aebe

      SHA1

      c975865208b3369e71e3464bbcc87b65718b2b1f

      SHA256

      1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

      SHA512

      6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_decimal.pyd

      Filesize

      248KB

      MD5

      20c77203ddf9ff2ff96d6d11dea2edcf

      SHA1

      0d660b8d1161e72c993c6e2ab0292a409f6379a5

      SHA256

      9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133

      SHA512

      2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_hashlib.pyd

      Filesize

      63KB

      MD5

      d4674750c732f0db4c4dd6a83a9124fe

      SHA1

      fd8d76817abc847bb8359a7c268acada9d26bfd5

      SHA256

      caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

      SHA512

      97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_lzma.pyd

      Filesize

      154KB

      MD5

      7447efd8d71e8a1929be0fac722b42dc

      SHA1

      6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

      SHA256

      60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

      SHA512

      c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_multiprocessing.pyd

      Filesize

      33KB

      MD5

      a9a0588711147e01eed59be23c7944a9

      SHA1

      122494f75e8bb083ddb6545740c4fae1f83970c9

      SHA256

      7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c

      SHA512

      6b580f5c53000db5954deb5b2400c14cb07f5f8bbcfc069b58c2481719a0f22f0d40854ca640ef8425c498fbae98c9de156b5cc04b168577f0da0c6b13846a88

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_overlapped.pyd

      Filesize

      48KB

      MD5

      fdf8663b99959031780583cce98e10f5

      SHA1

      6c0bafc48646841a91625d74d6b7d1d53656944d

      SHA256

      2ebbb0583259528a5178dd37439a64affcb1ab28cf323c6dc36a8c30362aa992

      SHA512

      a5371d6f6055b92ac119a3e3b52b21e2d17604e5a5ac241c008ec60d1db70b3ce4507d82a3c7ce580ed2eb7d83bb718f4edc2943d10cb1d377fa006f4d0026b6

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_queue.pyd

      Filesize

      30KB

      MD5

      d8c1b81bbc125b6ad1f48a172181336e

      SHA1

      3ff1d8dcec04ce16e97e12263b9233fbf982340c

      SHA256

      925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

      SHA512

      ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_socket.pyd

      Filesize

      77KB

      MD5

      819166054fec07efcd1062f13c2147ee

      SHA1

      93868ebcd6e013fda9cd96d8065a1d70a66a2a26

      SHA256

      e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

      SHA512

      da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_sqlite3.pyd

      Filesize

      96KB

      MD5

      5279d497eee4cf269d7b4059c72b14c2

      SHA1

      aff2f5de807ae03e599979a1a5c605fc4bad986e

      SHA256

      b298a44af162be7107fd187f04b63fb3827f1374594e22910ec38829da7a12dc

      SHA512

      20726fc5b46a6d07a3e58cdf1bed821db57ce2d9f5bee8cfd59fce779c8d5c4b517d3eb70cd2a0505e48e465d628a674d18030a909f5b73188d07cc80dcda925

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_ssl.pyd

      Filesize

      156KB

      MD5

      7910fb2af40e81bee211182cffec0a06

      SHA1

      251482ed44840b3c75426dd8e3280059d2ca06c6

      SHA256

      d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

      SHA512

      bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\_uuid.pyd

      Filesize

      24KB

      MD5

      b68c98113c8e7e83af56ba98ff3ac84a

      SHA1

      448938564559570b269e05e745d9c52ecda37154

      SHA256

      990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2

      SHA512

      33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\base_library.zip

      Filesize

      859KB

      MD5

      0d409bcd6cc6ecf3c4a8b1d6751f15f8

      SHA1

      0c12020cc6850855ea694b881c9be03ec572d35c

      SHA256

      1c8b1f6ec39ad3441c7856f4b28ba96f590abe26fbdc60de91f6a56599c3cf1a

      SHA512

      e247d66bcd43603c954c743a454cdeaa8482291389b61d65aed332b9159ad6c96da15e60917f6957010e5f4f99284a779a079aedc8b26558264313af925b4f39

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\libcrypto-1_1.dll

      Filesize

      3.3MB

      MD5

      9d7a0c99256c50afd5b0560ba2548930

      SHA1

      76bd9f13597a46f5283aa35c30b53c21976d0824

      SHA256

      9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

      SHA512

      cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\libffi-7.dll

      Filesize

      32KB

      MD5

      eef7981412be8ea459064d3090f4b3aa

      SHA1

      c60da4830ce27afc234b3c3014c583f7f0a5a925

      SHA256

      f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

      SHA512

      dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\libssl-1_1.dll

      Filesize

      688KB

      MD5

      bec0f86f9da765e2a02c9237259a7898

      SHA1

      3caa604c3fff88e71f489977e4293a488fb5671c

      SHA256

      d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

      SHA512

      ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\pyexpat.pyd

      Filesize

      194KB

      MD5

      1118c1329f82ce9072d908cbd87e197c

      SHA1

      c59382178fe695c2c5576dca47c96b6de4bbcffd

      SHA256

      4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c

      SHA512

      29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\python3.DLL

      Filesize

      64KB

      MD5

      fd4a39e7c1f7f07cf635145a2af0dc3a

      SHA1

      05292ba14acc978bb195818499a294028ab644bd

      SHA256

      dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

      SHA512

      37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\python310.dll

      Filesize

      4.3MB

      MD5

      63a1fa9259a35eaeac04174cecb90048

      SHA1

      0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

      SHA256

      14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

      SHA512

      896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\pywin32_system32\pythoncom310.dll

      Filesize

      673KB

      MD5

      020b1a47ce0b55ac69a023ed4b62e3f9

      SHA1

      aa2a0e793f97ca60a38e92c01825a22936628038

      SHA256

      863a72a5c93eebaa223834bc6482e5465379a095a3a3b34b0ad44dc7b3666112

      SHA512

      b131e07de24d90a3c35c6fa2957b4fe72d62b1434c3941ad5140fb1323aacba0ec41732dac4f524dc2f492b98868b54adc97b4200aa03ff2ba17dd60baea5a70

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\pywin32_system32\pywintypes310.dll

      Filesize

      143KB

      MD5

      bd1ee0e25a364323faa252eee25081b5

      SHA1

      7dea28e7588142d395f6b8d61c8b46104ff9f090

      SHA256

      55969e688ad11361b22a5cfee339645f243c3505d2963f0917ac05c91c2d6814

      SHA512

      d9456b7b45151614c6587cee54d17261a849e7950049c78f2948d93a9c7446b682e553e2d8d094c91926dd9cbaa2499b1687a9128aec38b969e95e43657c7a54

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\select.pyd

      Filesize

      29KB

      MD5

      a653f35d05d2f6debc5d34daddd3dfa1

      SHA1

      1a2ceec28ea44388f412420425665c3781af2435

      SHA256

      db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

      SHA512

      5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\sqlite3.dll

      Filesize

      1.4MB

      MD5

      914925249a488bd62d16455d156bd30d

      SHA1

      7e66ba53f3512f81c9014d322fcb7dd895f62c55

      SHA256

      fbd8832b5bc7e5c9adcf7320c051a67ee1c33fd198105283058533d132785ab4

      SHA512

      21a468929b15b76b313b32be65cfc50cad8f03c3b2e9bf11ca3b02c88a0482b7bc15646ce40df7fb42fbc96bd12362a54cffe0563c4ddc3fc78622622c699186

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\unicodedata.pyd

      Filesize

      1.1MB

      MD5

      81d62ad36cbddb4e57a91018f3c0816e

      SHA1

      fe4a4fc35df240b50db22b35824e4826059a807b

      SHA256

      1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

      SHA512

      7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

    • C:\Users\Admin\AppData\Local\Temp\_MEI17482\win32\win32api.pyd

      Filesize

      136KB

      MD5

      fc7b3937aa735000ef549519425ce2c9

      SHA1

      e51a78b7795446a10ed10bdcab0d924a6073278d

      SHA256

      a6949ead059c6248969da1007ea7807dcf69a4148c51ea3bc99c15ee0bc4d308

      SHA512

      8840ff267bf216a0be8e1cae0daac3ff01411f9afc18b1f73ba71be8ba70a873a7e198fd7d5df98f7ca8eee9a94eab196f138a7f9f37d35c51118f81860afb7d