35fbada1295957148ab2e1fdb1aa0a85c5384840f3fcaa0ca387dcd73e96e9a9

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d91bdfcf946b22a7d7f1b6571eebdeb2.exe
Size

4.9MB
MD5

d91bdfcf946b22a7d7f1b6571eebdeb2
SHA1

aa1c9a72af9cfd026fb7ccc052473d301fabe378
SHA256

35fbada1295957148ab2e1fdb1aa0a85c5384840f3fcaa0ca387dcd73e96e9a9
SHA512

f837968dfd421a72e551e493e42fcd2aa6ec4014c142b30e244e919a55ca9912559c02e30260547c90b66c104c670e547ef7c4ce22a33e566e7967bdaa0ecfe3
SSDEEP

98304:04T8MCOp4fek/tusNO9owpZdzyQ47tvE/SqF31/77G0kl819DCuf:04T8MJQtuC/wzp4ZqFlgsU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4200	put_file_on_here.exe

Loads dropped DLL 9 IoCs

pid	Process
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe
4200	put_file_on_here.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	put_file_on_here.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4200	4016	d91bdfcf946b22a7d7f1b6571eebdeb2.exe	88
PID 4016 wrote to memory of 4200	4016	d91bdfcf946b22a7d7f1b6571eebdeb2.exe	88

C:\Users\Admin\AppData\Local\Temp\d91bdfcf946b22a7d7f1b6571eebdeb2.exe
"C:\Users\Admin\AppData\Local\Temp\d91bdfcf946b22a7d7f1b6571eebdeb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\put_file_on_here.exe
  "C:\Users\Admin\AppData\Local\Temp\d91bdfcf946b22a7d7f1b6571eebdeb2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
76KB

MD5
8140bdc5803a4893509f0e39b67158ce

SHA1
653cc1c82ba6240b0186623724aec3287e9bc232

SHA256
39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

SHA512
d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\psutil\_psutil_windows.pyd

Filesize
76KB

MD5
ebefbc98d468560b222f2d2d30ebb95c

SHA1
ee267e3a6e5bed1a15055451efcccac327d2bc43

SHA256
67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478

SHA512
ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\put_file_on_here.exe

Filesize
7.3MB

MD5
d3ec45f77178f5e14e0761426a66e683

SHA1
f5730d9275aad6d0ba74b07e184ef03fcec38c9f

SHA256
18af23a18ac86bab698732888f4dd1057797c27e5a43d89ba072c726848b642e

SHA512
e1ac324cdb59220903a89cabbdbaea980d9b80607816d3b31379e231e2f4beb971f42052d6235cfb035a731d315127bad6bad19d68bbb5e1c2bbb55dc0c1e228

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\put_file_on_here.exe

Filesize
3.8MB

MD5
f0f5c1d24e5e7f0012b12ae344a448e4

SHA1
220bc6e3402c2c13bf45e760a13086e6eca01fc1

SHA256
68f81c54993a7e2c4ca56cc9286e00622793226c1ab08163b80f069f41d07566

SHA512
6c29beace4ad8c58826e2466ee81527b49ccbd2e5b47040d16a81b2c0b0f4cf7a652e7fa048b4c691afc03642d5b8c7f6e54bd9109349654f364243863f3effb

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\python311.dll

Filesize
3.6MB

MD5
c86f55416cf0ea641726e9261f2a1414

SHA1
7ad01a1b097a19ee8832f9c29b9fe687b2a9da71

SHA256
3298b1f3fda578fdfd3cb207f4250fc78e751372f8e751e0b5ff80d68efa62cf

SHA512
892310f8a82d6875d764f3839da86290a076cd20d2fbf1a7353e282178a715e0252c32fed69d679f8797eb6b0ce1b2260814926fffb92cd514eafb90f3fcf7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_4016_133535624653089578\select.pyd

Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads