Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 20:43

General

  • Target

    c99319e66df368ce8e34c71e95ce1d73.exe

  • Size

    19.2MB

  • MD5

    c99319e66df368ce8e34c71e95ce1d73

  • SHA1

    f9d71951e95a95150ea9cb274f48df164a2e9888

  • SHA256

    2e3f87014996ded9d141e32232acea889a8091e2a0f731e0b59c27e067192dbd

  • SHA512

    5d9038663f54d821285ae08d27d9de4c190ab567a7996a8ae08315eaf71a7de8200df90b20c29f024dfffc44d01e8437f7b31761d9d085474b3027b649c9f391

  • SSDEEP

    393216:7zuRB2BrXj8Fixo39c5hlERblh2pN2WmfDZMTtN3ZWITMax8T9GDTzr:7zSUxiEhk5Qpg7itN3Nxdf

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe
    "C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:180
    • C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe
      "C:\Users\Admin\AppData\Local\Temp\c99319e66df368ce8e34c71e95ce1d73.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\VCRUNTIME140.dll

    Filesize

    19KB

    MD5

    e5420478f4629aa0c01155efb1cae720

    SHA1

    aadc68186f91bd60a25d40a73d58f2d75814e7d8

    SHA256

    1a23796bd4255c8cd3d4229e8647d93605302ab603f180540be066afd20225b6

    SHA512

    3d21bb88b34083420e5455bd57c384e54f219bbb621e2fbb0f9928ccccab07efb3cb647e9931c70c555d1cef99196ab6c28bb48c7b4d26e39650b821c0dc6a8b

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\VCRUNTIME140.dll

    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_asyncio.pyd

    Filesize

    62KB

    MD5

    8cf9a316051bfc50f6dc343128b9c4e0

    SHA1

    3659ba74d2bc5b7d7ee806b95af71ec4dec76c13

    SHA256

    f934719bea056a98446e786de88cda8f76afe9a29e67121950b17caafc2799c8

    SHA512

    ad0e1fbf6744ae6d58768301e5ddc93eb2bf24f33bc49588097a03af915d51b296d815a36d9eefd671701289802075b1c850e8a5f4f453a81f0d53b28e65d6ae

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_bz2.pyd

    Filesize

    84KB

    MD5

    b89b6c064cd8241ae12addb7f376cab2

    SHA1

    29e86a1df404c442e14344042d39a98dd15425f7

    SHA256

    0563df6e938b836f817c49e0cf9828cc251b2092a84273152ea5a7c537c03beb

    SHA512

    f87b1c6d90cfb01316a17ad37f27287d5ef4ff3a0f7fd25303203ea7c7fa1ed12c1aef486dc9bbb8b4d527f37e771b950fa5142b2bac01f52afbfdbf7a77111d

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_ctypes.pyd

    Filesize

    123KB

    MD5

    4d13a7b3ecc8c7dc96a0424c465d7251

    SHA1

    0c72f7259ac9108d956aede40b6fcdf3a3943cb5

    SHA256

    2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed

    SHA512

    68ff7c421007d63a970269089afb39c949d6cf9f4d56aff7e4e0b88d3c43cfaa352364c5326523386c00727cc36e64274a51b5dbb3a343b16201cf5fc264fec8

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_decimal.pyd

    Filesize

    261KB

    MD5

    3e9395dc60b342fa529c2c805369977d

    SHA1

    174286c9c838d1983f13047e0bfa7d611259daa9

    SHA256

    9ebbf65d4f40d392b70631b6b5bf4c6384fa40ba7647c618f2832c874b7e7516

    SHA512

    4768f06e00f0df59168d776dde837156cb030e0635d10067aa83171f91c93d158d72084af1e2e914ed75b1d885b752290582980da468a4d3cf07ebcb1a02e4c1

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_hashlib.pyd

    Filesize

    45KB

    MD5

    496cde3c381c8e33186354631dfad0f1

    SHA1

    cbdb280ecb54469fd1987b9eff666d519e20249f

    SHA256

    f9548e3b71764ac99efb988e4daac249e300eb629c58d2a341b753299180c679

    SHA512

    f7245eb24f2b6d8bc22f876d6abb90e77db46bf0e5ab367f2e02e4ca936c898a5a14d843235adc5502f6d74715da0b93d86222e8dec592ae41ab59d56432bf4f

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_lzma.pyd

    Filesize

    158KB

    MD5

    6e396653552d446c8114e98e5e195d09

    SHA1

    c1f760617f7f640d6f84074d6d5218d5a338a6ec

    SHA256

    5ddba137db772b61d4765c45b6156b2ee33a1771ddd52dd55b0ef592535785cf

    SHA512

    c4bf2c4c51350b9142da3faeadf72f94994e614f9e43e3c2a1675aa128c6e7f1212fd388a71124971648488bb718ca9b66452e5d0d0b840a0979df7146ed7ae5

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_overlapped.pyd

    Filesize

    44KB

    MD5

    724c5f1347a77318bdfa4942a71ffdfd

    SHA1

    a284eeca1d336e9148de2a69d3728971b6cfa43e

    SHA256

    03ef0f32653e78901649b3207340c914786e0455369412ca160d76f553f81faa

    SHA512

    21463a489524eae93c4b734a56e07096a5620e48946d6c459e0ac5e451bf397130f022e4c5d8e26a5a9880d250a5d7ee0e4f508d66a174efb08d870c62a2d497

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_queue.pyd

    Filesize

    27KB

    MD5

    1707a6aeeb0278ee445e86ee4354c86c

    SHA1

    50c30823b1dc995a03f5989c774d6541e5eaaef9

    SHA256

    dd8c39ff48de02f3f74256a61bf3d9d7e411c051dd4205ca51446b909458f0cd

    SHA512

    404b99b8c70de1d5e6a4f747df44f514a4b6480b6c30b468f35e9e0257fd75c1a480641bc88180f6eb50f0bd96bdcafb65bb25364c0757a6e601090ae5989838

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_socket.pyd

    Filesize

    77KB

    MD5

    eb974aeda30d7478bb800bb4c5fbc0a2

    SHA1

    c5b7bc326bd003d42bcf620d657cac3f46f9d566

    SHA256

    1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016

    SHA512

    f9eea3636371ba508d563cf21541a21879ce50a5666e419ecfd74255c8decc3ae5e2ceb4a8f066ae519101dd71a116335a359e3343e8b2ff3884812099ae9b1b

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\_ssl.pyd

    Filesize

    150KB

    MD5

    fefbb91866778278460e16e44cfb8151

    SHA1

    53890f03a999078b70b921b104df198f2f481a7c

    SHA256

    8a10b301294a35bc3a96a59ca434a628753a13d26de7c7cb51d37cf96c3bdbb5

    SHA512

    449b5f0c089626db1824ebe405b97a67b073ea7ce22cee72aa3b2490136b3b6218e9f15d71da6fd32fba090255d3a0ba0e77a36c1f8b8bea45f6be95a91e388d

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\aiohttp\_frozenlist.cp38-win_amd64.pyd

    Filesize

    62KB

    MD5

    fc8a220585322021416cfc4bce9a9697

    SHA1

    76c9ab2cc8ae23e091baf4ae52a5ff1d0668a683

    SHA256

    5440e7d58e44d2cca5764b6e282da61c63990b5ef116d3c728909d55104a09a7

    SHA512

    c11785ac0b34492d69b45da3d3e489d819be28ff0f34f00bb6825934b74f94cdbe2f548eddd9c5d54dbba5f2664835b56323dc2d8159f04beb1552c072e96e4d

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\aiohttp\_helpers.cp38-win_amd64.pyd

    Filesize

    47KB

    MD5

    5bf893cde770aa22603f7d2ac1371c0d

    SHA1

    41f75dfa82550c84acc0e0efec53a921140842d3

    SHA256

    7ca04ff9661acf7bffcb3e557b0d82f12574c499d2c5b213d92b77afc43e17be

    SHA512

    c79d41b568ef52bcfe2555f1a6dd74ae8251dd984ecb03b9ecc35a8e2c8f84f2cd994d156b1df81a823c8f7fb1446989cc60182fb2b382ee217be258d52d9c16

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\aiohttp\_http_parser.cp38-win_amd64.pyd

    Filesize

    232KB

    MD5

    ac91ecd48574ce412e8e4d485df4ec77

    SHA1

    676a9bcf343e13e925f86cc6ae3dcb37e12885e8

    SHA256

    886115744bbd68d7d1406f8ce3bd8a6c51d86bd6c7ed760a8540baad9112ea4b

    SHA512

    8b11b6b403d0ebc9736dd2927a6318261cc626509a8b1ef946b89a81d0e9e8b1c9f05444a8d2ed6076c5cec9c38e9f03bb3d0e7ead7c871252c77b951dcb8498

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\aiohttp\_http_writer.cp38-win_amd64.pyd

    Filesize

    41KB

    MD5

    cdd7e78befd976319921ad58e871b026

    SHA1

    28b56d22e52cd2842504ea999a17c96e075313c9

    SHA256

    ad13169f77b799492f4051158997bdf9bca5a52eb1c834e9b385c60cc5619dcb

    SHA512

    1ba3ee6f535cfb67c9ea618db2841c1afa99a2893f93a240e28f57a5f225a868653bcb929077ff9eb42e7733c1320663d009e6bca70883ee857ab721943f0e19

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\aiohttp\_websocket.cp38-win_amd64.pyd

    Filesize

    28KB

    MD5

    9a6c957ffd7186ad86bdf823a416975e

    SHA1

    b269925b19f7c4b87bc2f2eecbc17d981c7ef98d

    SHA256

    9723dd25eff1cbf3d5d2da25604a2bebacd2476b38c2872aeaf3b6a3403a584e

    SHA512

    6e35dbed54a68f33999a20e18715d44420c3a21f05f85b0f465f3275729047335759467e16f9d757b1ea166e4736df98bea56cb58b7721d36f70e7d7f9872466

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\base_library.zip

    Filesize

    759KB

    MD5

    df8b8c969ff2b6f8bb7366501364edea

    SHA1

    abe794715ba88790786c171625db7547f6f7dbac

    SHA256

    6cb8ff9586c8511e415b08fb2ea329c66eb4e19c345a951b29781f8bf6de3b08

    SHA512

    80415fce07ddc2bd4ccad95b9d4899ee7745a5f001880e72f8eee80eca884ed432a9dcbf1301cf193e09f89d74393469cdd7e2d5eca89b77e40b98323cbf5a3b

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\certifi\cacert.pem

    Filesize

    253KB

    MD5

    3dcd08b803fbb28231e18b5d1eef4258

    SHA1

    b81ea40b943cd8a0c341f3a13e5bc05090b5a72a

    SHA256

    de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e

    SHA512

    9cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\libssl-1_1.dll

    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\multidict\_multidict.cp38-win_amd64.pyd

    Filesize

    43KB

    MD5

    c43c2103add8c6c30f25b9e46e086147

    SHA1

    7a04d0dafcbe1036033c99d3e796422cba382796

    SHA256

    d31834c5ba38b1654ccecdad6423d2c15fe58593f2dfba291ca0753e5ad2f8ce

    SHA512

    b1d4f101543b1788c0e6137ff8c32b362082174618dc0ef888c692bde0fa54c182e4e2d8b7137e7cb20c1621336bc388aff6f88015ce4714c11254c10462e9bc

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\psutil\_psutil_windows.cp38-win_amd64.pyd

    Filesize

    76KB

    MD5

    81467ae2ccfd303b3ae249b271d02393

    SHA1

    025316c0ffd42bb6085731596b5e5cf36a2ee400

    SHA256

    b8dfb9df359c67334c017a8bdcad257e4ed5ef1637761acf40d19c4df040f8e1

    SHA512

    3d4f02a97298d894e351514c9d719730b7de4baace38fcf395275bdde399158d35d10533a5ae762c24b748594e64109112a8d88f1b76b15beb2af47bc7db272e

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\python38.dll

    Filesize

    576KB

    MD5

    25882c6bcfee23c5511efd16a7f73cf6

    SHA1

    c8da7e56db5e156ad2a21f4c2198ebaba2e4c9b3

    SHA256

    326f262ef703bc0fe6c8d258023f33711a87745c537fa547ecc886cbb89139b1

    SHA512

    61778bad564932dc63eff73992c39c49c5bf600f282d621137ec3355193a5fd1ef000c70b959a015fdc1757627558c19ce365e794a1eb472948d9aeeaa57e621

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\python38.dll

    Filesize

    4.0MB

    MD5

    3cd1e87aeb3d0037d52c8e51030e1084

    SHA1

    49ecd5f6a55f26b0fb3aeb4929868b93cc4ec8af

    SHA256

    13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8

    SHA512

    497e48a379885fdd69a770012e31cd2a62536953e317bb28e3a50fdb177e202f8869ea58fc11802909cabb0552d8c8850537e9fb4ead7dd14a99f67283182340

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\pythoncom38.dll

    Filesize

    560KB

    MD5

    efd05544ac3a7f0c7e38223004c1b81a

    SHA1

    2973a5c4d2d118fe66b6591455a90c33811ef3cd

    SHA256

    b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b

    SHA512

    3a25385ace2ca903df5bf9e04befdefa84fc325c53c379bf658df8033ac07bbf1a4ae7d216b77bb6b1f94bd8f99417d5d052d89f63f80250fb7cc6a91a05ba4a

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\pywintypes38.dll

    Filesize

    141KB

    MD5

    d273b6494c4761536d6eef26e01956f1

    SHA1

    a6e65c6745a593a23b20cbe9b8ba3414e46e50bb

    SHA256

    28680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6

    SHA512

    65db50b36c8b1d1285e1659e1a67dd02329eac330192609a247057b535053571251f450865a9ccf3c86f23d2017b6950d68108c7171bf840f07958b39a034ae5

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\select.pyd

    Filesize

    26KB

    MD5

    08b499ae297c5579ba05ea87c31aff5b

    SHA1

    4a1a9f1bf41c284e9c5a822f7d018f8edc461422

    SHA256

    940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281

    SHA512

    ab26f4f80449aa9cc24e68344fc89aeb25d5ba5aae15aeed59a804216825818edfe31c7fda837a93a6db4068ccfb1cc7e99173a80bd9dda33bfb2d3b5937d7e9

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\ucrtbase.dll

    Filesize

    192KB

    MD5

    1638852c4ce63769de89cad6c0083761

    SHA1

    55f927642e98e53d154f695819fb5cb4cb8f8dda

    SHA256

    1f3a8b73d38aa3b23cf75583ba1f389adfc8e444be1dc6fcd30be80771e6d214

    SHA512

    cfb2f8a757c9654b258fe94ea176b5d70294bc14295d7f7b4ba59163b6f56521c37b22724d4bbb37007995e288c99ee4689d9330d55031837cafd9f1b7221e2d

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\ucrtbase.dll

    Filesize

    704KB

    MD5

    0b811d973e6dc3f080ef3c86a1a5df36

    SHA1

    052be9b5680b81a296c716bb884aeb0b0589c6c9

    SHA256

    0a5dda64e735b1d638e3c6a31fb899a5ca09c4552ca9ccc0549ab4b9a9acb178

    SHA512

    19a34d79bacfe6024d92c706c4b3142287c5f9e19d75476c5466e8030590ccd57aa0da3811063f8ba9d96c8744dcd2a619bdeb990545eb79dee6c4c84ed0e4ed

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\unicodedata.pyd

    Filesize

    1.0MB

    MD5

    84fb421643cab316ce623aa84395a950

    SHA1

    4fba083864b3811b8a09644d559186ecb347c387

    SHA256

    5578c3054f8846be86e686fb73b62b1f931d3ed1a7859b87925a96774371dba4

    SHA512

    a2132f93b0e4292dc9c32da2a6478769ec4f58be5c36ee2701e2a66154ea1dc2c0684fc7698e7c3ac04f5c1d366cb9633a9366e5a38b7ff7a964ff25ea266f9f

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\win32api.pyd

    Filesize

    132KB

    MD5

    701d49790343f77b9cc78033f47772b7

    SHA1

    7f9031b27c30fe9b5a7432bd92505bcd5fcaf600

    SHA256

    e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257

    SHA512

    c15e89bcd6e9bd12d31514b1110a6347c0fc1809c6dfeb711f08a7ca51d19b3a7db856f0e1240d953bc8316f2066bbe1f012f588a7a925f98d29a991f8c40620

  • C:\Users\Admin\AppData\Local\Temp\_MEI1802\yarl\_quoting_c.cp38-win_amd64.pyd

    Filesize

    78KB

    MD5

    e96e99fc84249de9c4cd4649f3a27f7b

    SHA1

    4fcf885311d24a2ce438842bb7db269550709a00

    SHA256

    3730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303

    SHA512

    19aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79