Analysis

  • max time kernel
    118s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-03-2024 20:43

General

  • Target

    c99319e66df368ce8e34c71e95ce1d73.exe

  • Size

    19.2MB

  • MD5

    c99319e66df368ce8e34c71e95ce1d73

  • SHA1

    f9d71951e95a95150ea9cb274f48df164a2e9888

  • SHA256

    2e3f87014996ded9d141e32232acea889a8091e2a0f731e0b59c27e067192dbd

  • SHA512

    5d9038663f54d821285ae08d27d9de4c190ab567a7996a8ae08315eaf71a7de8200df90b20c29f024dfffc44d01e8437f7b31761d9d085474b3027b649c9f391

  • SSDEEP

    393216:7zuRB2BrXj8Fixo39c5hlERblh2pN2WmfDZMTtN3ZWITMax8T9GDTzr:7zSUxiEhk5Qpg7itN3Nxdf

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 47 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe
    "C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe
      "C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\VCRUNTIME140.dll

    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\_bz2.pyd

    Filesize

    84KB

    MD5

    b89b6c064cd8241ae12addb7f376cab2

    SHA1

    29e86a1df404c442e14344042d39a98dd15425f7

    SHA256

    0563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb

    SHA512

    f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\_ctypes.pyd

    Filesize

    123KB

    MD5

    4d13a7b3ecc8c7dc96a0424c465d7251

    SHA1

    0c72f7259ac9108d956aede40b6fcdf3a3943cb5

    SHA256

    2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed

    SHA512

    68ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\_lzma.pyd

    Filesize

    140KB

    MD5

    f5ed57bd28de184addaca5c8c3cd1ff8

    SHA1

    5c2dfa4ce62e831b0e74c2f164c64c439cb46c90

    SHA256

    253942f60eab7962121d897826e785022e16a0e02614c3578f8b3a872ff608d0

    SHA512

    3cabf04559665ac2adc576187c4eb2ad10c7386ee034cf77d5fec0828314e0d15decdebcf61903044436b7db87bf81bce5e51af459a3a2c059a187f23a8c69a9

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\_socket.pyd

    Filesize

    77KB

    MD5

    eb974aeda30d7478bb800bb4c5fbc0a2

    SHA1

    c5b7bc326bd003d42bcf620d657cac3f46f9d566

    SHA256

    1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016

    SHA512

    f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\_ssl.pyd

    Filesize

    150KB

    MD5

    fefbb91866778278460e16e44cfb8151

    SHA1

    53890f03a999078b70b921b104df198f2f481a7c

    SHA256

    8a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5

    SHA512

    449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    1bab66681e21a40a87bd7b869154ea3e

    SHA1

    4cd8f6da8a269c9f92915e557018b660e9a67543

    SHA256

    20560798f43a79ef390d9bc42aea3a59918c9440fb1404b420072b2048d77def

    SHA512

    8d184572a31ad33d8350170c9d4ca3f7fdb2675bc8569d5a917b13da798ce4b3aaae231be81e5f09fbf98369b8769c71ebd1a128745bf2f9829230eee141d6b5

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-core-file-l2-1-0.dll

    Filesize

    11KB

    MD5

    1f061fd38e9e8717f1a6b9463929e9e2

    SHA1

    332b69d41c480c89bfc3840e132754cb19643146

    SHA256

    843a7cab04233f656081ddbeceeb58a7cdd2e2b1a04833f8acc4d361d2909abb

    SHA512

    c1825476f8a1dc11cdee5511d367ff66657e86840a57984711ab09814af9f588fc4b16ce6e63e446bb7ea16de2fe1bfdc91e71fa42285e0934b655f1a22cb579

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    a9511d3c0f01d3855e6d66066287b270

    SHA1

    1adb59fad65559234978ddb1aa594954392756e9

    SHA256

    e4d3c421dfcf3a68ecba5ad4edd6bf55fcbed486a1417af9beaa9a1d62fb7e2a

    SHA512

    584ae6d9d7b55caad035ebca284e848ca4875dbb8e8626093b7764d66907410f5b6bb0ecbc8f52269041707e47e8fd5781f2be26118125ad6efc6365bdb4d253

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    7ecd60a32b006faa9b2618182fdaf1a4

    SHA1

    c6f8a363efd6a10abcb5b644ff49e26a0dd54c1a

    SHA256

    647442d40ea1bda158ceef56e3ec3d2e66fff1702de469e9c2ff162f1bff6161

    SHA512

    091029146cde34ce72916b5c090725962d63b53d1455aa96265cd3af98609994430dda2bc38f72a3aa8b2bd973680c83ff486d41c6ec0fa8a1cf43baef99bfc2

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    c45f1192763d4407778990a072b0dc74

    SHA1

    5b9f5813da5e76e87cf158ea610fbe6152a091bc

    SHA256

    434a06fb89164aff7b18acaffb079ba074e4dae782ac005680395e052a28f30e

    SHA512

    c1c68dd4b3418d37aeb074557cce2ff5c7330679f53cd5e1af8e92c90c7cf954538373a3cabb505d160ff68c0762acd5f8ef901046bab7ec70e44de3c8160988

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    12KB

    MD5

    833b2f70c9678b56133d69c2e4b67514

    SHA1

    7ff8544e56dda0dfccce716511bb9eb0e5cf9822

    SHA256

    3828e4a7a4ede679807577df73db4561469a5757bad52f241508ca84b3cbcdc7

    SHA512

    df0e0ae4ec65be16a725003abb7605f5a7fdc5e4c087bbb5d6dc57636aa47dc3042dcd01cd277d770b5781878bdb4955b945e244dea4fd7c9be8ca9532c0fb5c

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    15KB

    MD5

    f789e3383d73aa3fa3c35cebe27a6fe6

    SHA1

    3b887ab640181e350b78e30818e1b47c9c1ff11c

    SHA256

    60c3428168002b09fdc246cf948c8341c3b2a1a0e1f70cedcdd6eab59b8e2d08

    SHA512

    fd10635929e7598f05174fa3617fdb828547687898248376760c294570665c552d6e58215b9ea68b99ff5483c8657bb041cfdc9ed92cc0cfc1be7736eafb2b9d

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    11KB

    MD5

    673bec1368a19fa839cc77492ebe1c98

    SHA1

    c87c250ce43d760f4f07ffca2f4dabbbbe90edea

    SHA256

    63077ff3b5315688ed1ada38d05b15a713921e862a34ffc9260f30d3fd00cc7d

    SHA512

    52424b7746833934ec2c1b0b61246324a1c5cba164fd2f29562c6bde13333ddfb72907cd9107e72b7d7f5cf34ebb52a9b95eb37bb27dbce5cf234badee02a765

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    13KB

    MD5

    ab3369337c192d0ae9306af0ad030cef

    SHA1

    50577bf4eab40dd9ed9bd163ead95a0ea72b9597

    SHA256

    918411e05e727e6d42fe19b37c878d5ea461dc86f3bb8c21652c46d0088de8b4

    SHA512

    97a9426cf286b486cfa046867bf06e0458af2625634bd19786e69c9e6e42722f37cd4de8089033f5eaaa9d0baa835bf4e3d180bb0da3f6ba221c34bd75d141b8

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    11KB

    MD5

    66345ba9fae2de5be6dad2f2cb2c263d

    SHA1

    52d178ac3710f3bc622832c7b6ecb3682c340267

    SHA256

    13c9432b4e54ba7699c062f5f20fcfa083e77059b7b6bc33db2cef5767d49227

    SHA512

    a4db4fa07329d26d91f432d1c7726295a82f9cd6c21685cf190399db4a54bf38005d4041cbe6f9676bb264065602d7f0cb1f81d59a703ac994b6ba1c57f0ddf8

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    c8cb7df56c4e4c6b461cd7535c34dd3e

    SHA1

    881e0c16579e86d0f3def8fed98af64ba1ff6f2c

    SHA256

    de95bf6ecffb6aeb31bba8f62bb282f87e4b5b19659eca4b2435b2be2999c9c8

    SHA512

    19c354ee6d7645bf141889ce63467b3884ffdfd2964c7a873a80ec9fd10ed324b961869b0d06eafe222e7a064b77a8d7515b5c841872876ec19aa12dafea8b0d

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    20KB

    MD5

    3c76c9213112a111275ed5daf7b20a1e

    SHA1

    a9c2b0619c46c975637f1e0c4b80be7155fb158c

    SHA256

    7a75c4c14da9f0e6d9c597321ee3a6531f903bbce33b83259eca611f62877c60

    SHA512

    a058a5eeb3d8710aeb0098eb2b9f637cbe54631fc775dd5e054c99c018d3d91eb1d4561acc15c2bff8a2fd0900e0b85d0371768d56f46344f55982e9c837c7b3

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    12KB

    MD5

    f4fa9e3d84e97b0f1f31c2c57ded56d1

    SHA1

    2a2cd7d6539e0f5913257f67e9a2ecbea974811f

    SHA256

    1c8b9cfecb68e60c151ebb2a305291e70b7584faefd8c02df331b3713f11c5f6

    SHA512

    9a18c121b48c7364b66631c0c730abd9044849be372932cbae352ae45dca1766d45afa4ad68048dad5a11407d04e059408a49d9fb46328b5e3bcce633efb5178

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    bf0c335428a9bdd676d726199dc9e517

    SHA1

    f9ef3ae33686176ec542f870da6c092b5c21c0cf

    SHA256

    4c93b20d7f2ccedc725f3f718f24e23d6a2148f0d73ea1d032c2eeba6b16afb0

    SHA512

    feecbd04acad88bc1a352c5ddfeff34acacf5c88b6ab3143692305378b1cb7b6204bfc8cd84abbc56c3ab279f39d1e75e3fe6904216d818de0a28b801a7c0928

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    17KB

    MD5

    a6d215393c7498005368b636ce8ac831

    SHA1

    b5b7ca683ab0736644a3fe9e51714b3d358d5adf

    SHA256

    12f0707c435d734fdec382b3475019b86e724902197b234a9788d9d6cb1e200c

    SHA512

    6c929ad71e4b1b7d92b692ba7faf9b16e66035bde6b1c2d53885badd3c65429a2c8c379be15a3f14e97ff00c05400eb4b4083d7955bc984b662c78fc5ac5f693

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    839e3484564f9141c7f047e336b84930

    SHA1

    dd03d279120ef382af0413c36fd4c58129a1e0c4

    SHA256

    4e07911d2d2bf39b8b5ccabe1427f094b8feb3e0e5a5a691c4533d3bf5e58d56

    SHA512

    dcc79e6f19a3bae6e83144cf466268e0c7f8ce22de5a6561c3df2cd536daa640282541e8943cf3b93d93610e97c52cd4f1a32febbe21828e03453de571537bc5

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    4a991ee39fc196089364ec5a22dc9dce

    SHA1

    f121bc9ade49b8e1a57ea681ea2e18d40136f01d

    SHA256

    c3e1514c2e4d12ca10581dd4ac16ccc9ed055ea408b6c47a7eaaa32432652315

    SHA512

    2f5f8b8ea0bee4792f90110dfef3c553b7d322618e3534227edd395510c10e5ef346ad06e340f519ef69e20302eac12e6144889ce733ce923134501ebfb2fbaa

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    bd2a0d3099e6f4dcc788d8e7d47095d2

    SHA1

    57ac6d00f21e9d7377157d9f5935b9cf27454f9d

    SHA256

    4f199489614cf260c71242ba85c948b7a7d021d4a2295298aeb937e0f3b65682

    SHA512

    1eb57e28010acb4cfd06b219d64efcec2dde6f80bb1e6cffdab3ce31b5c5000588c8a08daf4c7a6f44f0e6d6f71443f0cf87833b5cbb173e6900d9a20a6720d4

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\base_library.zip

    Filesize

    759KB

    MD5

    df8b8c969ff2b6f8bb7366501364edea

    SHA1

    abe794715ba88790786c171625db7547f6f7dbac

    SHA256

    6cb8ff9586c8511e415b08fb2ea329c66eb4e19c345a951b29781f8bf6de3b08

    SHA512

    80415fce07ddc2bd4ccad95b9d4899ee7745a5f001880e72f8eee80eca884ed432a9dcbf1301cf193e09f89d74393469cdd7e2d5eca89b77e40b98323cbf5a3b

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\libssl-1_1.dll

    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\python38.dll

    Filesize

    4.0MB

    MD5

    3cd1e87aeb3d0037d52c8e51030e1084

    SHA1

    49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af

    SHA256

    13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8

    SHA512

    497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\pythoncom38.dll

    Filesize

    560KB

    MD5

    efd05544ac3a7f0c7e38223004c1b81a

    SHA1

    2973a5c4d2d118fe66b6591455a90c33811ef3cd

    SHA256

    b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b

    SHA512

    3a25385ace2ca903df5bf9e04befdefa84fc325c53c379bf658df8033ac07bbf1a4ae7d216b77bb6b1f94bd8f99417d5d052d89f63f80250fb7cc6a91a05ba4a

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\pywintypes38.dll

    Filesize

    141KB

    MD5

    d273b6494c4761536d6eef26e01956f1

    SHA1

    a6e65c6745a593a23b20cbe9b8ba3414e46e50bb

    SHA256

    28680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6

    SHA512

    65db50b36c8b1d1285e1659e1a67dd02329eac330192609a247057b535053571251f450865a9ccf3c86f23d2017b6950d68108c7171bf840f07958b39a034ae5

  • C:\Users\Admin\AppData\Local\Temp\_MEI12242\win32api.pyd

    Filesize

    132KB

    MD5

    701d49790343f77b9cc78033f47772b7

    SHA1

    7f9031b27c30fe9b5a7432bd92505bcd5fcaf600

    SHA256

    e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257

    SHA512

    c15e89bcd6e9bd12d31514b1110a6347c0fc1809c6dfeb711f08a7ca51d19b3a7db856f0e1240d953bc8316f2066bbe1f012f588a7a925f98d29a991f8c40620

  • \Users\Admin\AppData\Local\Temp\_MEI12242\_lzma.pyd

    Filesize

    158KB

    MD5

    6e396653552d446c8114e98e5e195d09

    SHA1

    c1f760617f7f640d6f84074d6d5218d5a338a6ec

    SHA256

    5ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf

    SHA512

    c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5

  • \Users\Admin\AppData\Local\Temp\_MEI12242\python38.dll

    Filesize

    3.9MB

    MD5

    9e6a496933f79f43884689b4fe8d7b08

    SHA1

    c8e62d761f073078dbc4505ac75eba0d21bb7fe8

    SHA256

    35d50cad3da8583769cc4e44b17f113f5c6bd227d02adee999f04c28ac7c5d6f

    SHA512

    0b6e0b19e6aaf575a3f6ac0fcb75523645f9a0413628cf284f9548a1bfe38abb00ee0e2883de00599a09917855f57c24a2415e82baaa3dd1301b56457df54789

  • \Users\Admin\AppData\Local\Temp\_MEI12242\ucrtbase.dll

    Filesize

    971KB

    MD5

    bd8b198c3210b885fe516500306a4fcf

    SHA1

    28762cb66003587be1a59c2668d2300fce300c2d

    SHA256

    ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2

    SHA512

    c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5