ff0c0fc21fdfc6ce981077a62aaeec378226e27d8e8dd798c68475b02b47eda0

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Illegal_Services-main/lib/bookmarks_parser.exe
Size

4.9MB
MD5

0024fb2a8b21fd0b100b4569fb2db2de
SHA1

e0e29770b67a8462849fb8e550a50ee802a9591e
SHA256

a1be50e4f27588775579853e450b80495a8e54b441ac0d1bb289eecc595674b2
SHA512

1dbe968ce41b783aa2f916a6a7fa1d34a1e82552cdff300d0ce449f1afdba28fd7bc81cb785f9ec5417edf6aaa428d4d2007208876fb4f130e3ede188865c7b7
SSDEEP

98304:PWZpdAeYVH917pxX+T5zCTZT6FQ/C3QnVDZhWwA7r3vsQBaWlhTV5qc5k+QH:ejAeEPK9C6Q/OQVtQw2r3vpEcLIc

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
760	bookmarks_parser.exe
760	bookmarks_parser.exe
760	bookmarks_parser.exe
760	bookmarks_parser.exe
760	bookmarks_parser.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 760	3624	bookmarks_parser.exe	85
PID 3624 wrote to memory of 760	3624	bookmarks_parser.exe	85
PID 3624 wrote to memory of 760	3624	bookmarks_parser.exe	85

C:\Users\Admin\AppData\Local\Temp\Illegal_Services-main\lib\bookmarks_parser.exe
"C:\Users\Admin\AppData\Local\Temp\Illegal_Services-main\lib\bookmarks_parser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\Illegal_Services-main\lib\bookmarks_parser.exe
  "C:\Users\Admin\AppData\Local\Temp\Illegal_Services-main\lib\bookmarks_parser.exe"
  2⤵
  - Loads dropped DLL
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI36242\VCRUNTIME140.dll

Filesize
81KB

MD5
5116fd80399d5af500badb186c866cde

SHA1
8dfbcdd296383aebc039058101aac1ae408e5152

SHA256
1e5dc86e122379740724621890a1ba1b18252c745631a6dff862aa7723a1f99a

SHA512
e41b71380fa49743f1efcc920276dbf1b2f7f5db5771f64a4d2ff18039c124efdb3b7d3fa66eda2c47b21012abe1186eade388b38dcaa7e8417707be546c65d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\_bz2.pyd

Filesize
70KB

MD5
69571f3b3b8a1101515e4aee7f080cd1

SHA1
67cbcbac47499b15a60343b67a80cd16c4a9c197

SHA256
7a9c1b992529281ffc38944580dd858e85d4a76620c768839fb7fb7c21771989

SHA512
5b110ce65a93e03205fc4bac5fb2c83e3f67aae1e84a1d5503589ce43e843c29a31379c013e43533c84e70c0a82e5db8fbe63a678e20b8cefa515199bc599c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\_lzma.pyd

Filesize
137KB

MD5
76677f460125603976656f78b8af6b56

SHA1
0664d710ef55f5c58178ce44c185a4c0ad10a31a

SHA256
a8f71849e92ef2455488b5a9334bd0c378b92f75b089b3eddb284c0ca545060a

SHA512
60a8d0c95553700ad5c18f4c5fc5475e22c8d42ccbe7bc26530649695e18cecf2202c55bd4c7d3a943a018f6737b9ef262f52cf75c5e8df63d72eca40fcff442

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\base_library.zip

Filesize
1008KB

MD5
3c39f09efc25551e8d79d60ac23d205c

SHA1
c965fc04fbf09de3cf012dd8171c707d717da537

SHA256
52e1825807e78e761671a757848e3eac5f1c19fd26b1e238846b4086d0b01809

SHA512
63323c079dd880058c3a1af8c6dd6df969d3b662a358b1b09273c401cd7cf2e0c1dbfa6cf65b5df201aaaa11c46188a2e13ec909cdfd8e1263cb1b129ddd06ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\python38.dll

Filesize
3.3MB

MD5
a6b10a3a1f33d9fe136d0a33ccfaf515

SHA1
208ff72618841a8dfef88d740ba09031df30e992

SHA256
fa7856e27d6c177df9284aad00165dc004ba6ee8ad26b816756596b8d53e71e7

SHA512
7278b861112afbbdbf98a6f6559e30d363e17c68832853d18a474b38ce3fdbd9f9cbb11fdf531d2f6ab54fc83f15786bdeb5ebec9655564ea7ce45485a29b332

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\python38.dll

Filesize
2.2MB

MD5
6298c09bdbc32ebaccf6f6cb681aa6a5

SHA1
55eba50fb3ff8d443e526d9994960e607fca5178

SHA256
bb1c5d23b6bf648dd56e66268ce319a7ce3f0d239336c47346d94108f7703a1b

SHA512
65cce37ce7c2c87e262cda6ff6ac7f0c70e485dd654aeafa99681a2092b20453db67c58b964b8e49b0c2471ae4e43761bb0a10a99db6a7a48407abf0f9fd8050

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI36242\ucrtbase.dll

Filesize
893KB

MD5
a924b24d71829da17e8908e05a5321e4

SHA1
fa5c69798b997c34c87a8b32130f664cdef8c124

SHA256
f32a61d91264aff96efd719915bed80785a8db4c8d881d6da28909b620fe466f

SHA512
9223ec0e6e0f70b92473e897e4fd4635a19e9ca3aff2fe7c5c065764b58e86460442991787525ed53e425ecd36f2881a6df34c35d2a0e21b7ac4bc61bf1cbeab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads