1ba4ca0bb5453972c66f0f63e53bfe7c8879fb3814ce1b1e250f8c7da634cfa5

Analysis

max time kernel
80s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

7.3MB
MD5

017f0a00a25c036c9e775bda90000cdb
SHA1

f382a38b498d2d75dde999c060a650dafe2b24d3
SHA256

1ba4ca0bb5453972c66f0f63e53bfe7c8879fb3814ce1b1e250f8c7da634cfa5
SHA512

40e32ffc851804cb9f2d9de272abd7e8644870c7710f8b2c5891ec7565f1670e548d533114f3562b89082b4007c546395c3b763073c892a3ad82690e49d8263e
SSDEEP

196608:KwsTs+gp1Dcz9onJ5hrZER3xQ3jo4UwSEw7+JmZlZa:+4pNcz9c5hlER3xA2RJS4n

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 14 IoCs

pid	Process
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe
876	main.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4092	icacls.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 876	1496	main.exe	88
PID 1496 wrote to memory of 876	1496	main.exe	88
PID 876 wrote to memory of 4584	876	main.exe	89
PID 876 wrote to memory of 4584	876	main.exe	89
PID 4584 wrote to memory of 4092	4584	java.exe	91
PID 4584 wrote to memory of 4092	4584	java.exe	91

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
cd7a242a7fa6cf48a28388126d1f321b

SHA1
8db3b5953785b1b0aece5c27268afa2d0149a6c2

SHA256
7da104445376bf953447cfbe836878e8bb73fca0fba78852df0d034ede100f94

SHA512
e346bdc46f1ac7ef24a11bf89de8a07bf421783d943378f51893a70d692600f030d526d1dd1043c1e26fe02a5d255109bc2cb4f090446907500f0aa4e127b339

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\VCRUNTIME140.dll

Filesize
91KB

MD5
7942be5474a095f673582997ae3054f1

SHA1
e982f6ebc74d31153ba9738741a7eec03a9fa5e8

SHA256
8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

SHA512
49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_bz2.pyd

Filesize
84KB

MD5
499462206034b6ab7d18cc208a5b67e3

SHA1
1cd350a9f5d048d337475e66dcc0b9fab6aebf78

SHA256
6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e

SHA512
17a1191f1d5ca00562b80eff2363b22869f7606a2a17f2f0b361d9b36b6e88cb43814255a5bac49d044ea7046b872bac63bd524f9442c9839ab80a54d96f1e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_ctypes.pyd

Filesize
123KB

MD5
b74f6285a790ffd7e9ec26e3ab4ca8df

SHA1
7e023c1e4f12e8e577e46da756657fd2db80b5e8

SHA256
c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a

SHA512
3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_hashlib.pyd

Filesize
64KB

MD5
60f420a9a606e2c95168d25d2c1ac12e

SHA1
1e77cf7de26ed75208d31751fe61da5eddbbaf12

SHA256
8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c

SHA512
aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_lzma.pyd

Filesize
158KB

MD5
bc118fb4e14de484452bb1be413c082a

SHA1
25d09b7fbc2452457bcf7025c3498947bc96c2d1

SHA256
ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3

SHA512
68a24d137b8641cd474180971142511d8708738096d865a73fb928315dd9edf46c4ebf97d596f4a9e207ec81828e5db7e90c7b8b00d5f416737ba8bffc2887bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_socket.pyd

Filesize
78KB

MD5
0df2287791c20a764e6641029a882f09

SHA1
8a0aeb4b4d8410d837469339244997c745c9640c

SHA256
09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869

SHA512
60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\_ssl.pyd

Filesize
150KB

MD5
66172f2e3a46d2a0f04204d8f83c2b1e

SHA1
e74fee81b719effc003564edb6b50973f7df9364

SHA256
2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01

SHA512
123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\base_library.zip

Filesize
758KB

MD5
beb4c0da2cf0a5d2dd5219f04db24004

SHA1
944ccafb653b02e2997a98c9f17e10b3f06b70da

SHA256
05473737f04ffa0e0400013384e217a9a5ca9a4c107af08ac278cff07afda105

SHA512
b6c1bfdc40e93658ea3f490e84080c0aa0f2e16d2f117040b2981f72adefe3686910b130ca267df12be7c9aba6e8920d10c145307501df5ac038439b255aec81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\libcrypto-1_1.dll

Filesize
3.1MB

MD5
2af7c1c9f0fbe54d2404d6eb05b278c6

SHA1
89d05536cc7843b87104a7b868ae8170e2f9806c

SHA256
967f8206dc5a02d685e101f82bc20b712fbc0a9a9a0bde6a2309f4967e5ab9d0

SHA512
2da7166d0986990233e8003ce18c0d0b3f7c0e1f86f8753bc4c271401b889b3eedc689a3ea0697b3d72c838c437d94cb88f56c4022d44ed0abe86e2297b18f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\libcrypto-1_1.dll

Filesize
3.1MB

MD5
94a562832cc94da9ac780e323ce8fbd0

SHA1
5ea5c3aeca38872526afac139f48198acfd0ced2

SHA256
285547056de451455f1dddc48bbc2fd864c96c252ee18f0daece8670d29d5f3a

SHA512
242c835672e62c00c2ce14dce879fd3e3bf871b3d66c0bce39cfd7459b5304994542d36b6271a379b88dc74f233ac05783da97ef000a1feda629f17371b11dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\python39.dll

Filesize
2.1MB

MD5
282b2822702c25bbc0e35d964e065cd4

SHA1
9adbce930900c2daa5ac630a98eb27e4177ad96e

SHA256
d77ae863efe8aae306afd746d1b5bbbb6cc86d3c2dca82daf07c55f860c18b6d

SHA512
6ae1408d7f44319b2644b9421c507555fcd8208bda42fe8a53b8024c8fa32642bd4bd427fe962dcf889a6330b2ae61643e178333693535f9e9798b9a9d050470

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\python39.dll

Filesize
2.4MB

MD5
194235d2d83d807235513a73fdb9d9c1

SHA1
489317066cdfff875ec34ca2b8de923f63c2de60

SHA256
9a67d9121dd9036194a64c835dba58482401c940afe4751351f57cb999cbedcc

SHA512
01b37d68b34621966c8ca23908b530f4f22636b51e68b158f7c3b5ef9d4300e0749db9023306aaca526dfaa9185b314c96c092bd53c0df548d5d407c0dfb6fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\select.pyd

Filesize
27KB

MD5
a2a4cf664570944ccc691acf47076eeb

SHA1
918a953817fff228dbd0bdf784ed6510314f4dd9

SHA256
b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434

SHA512
d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\ucrtbase.dll

Filesize
986KB

MD5
adf1342f52833831d2a67115b2c9e9e8

SHA1
88bf825535a19e7b2c42b68e6378af821bc75148

SHA256
83d31cbced68513824465dae16b5f01f21baaabad3ae4f2dbfbd39dadeee7a0c

SHA512
23b708e74d653bc3dd4c73ecc10dc48df09e53c19079c17174b13b3f842d4e81540ed3b87feb2f7ae2e77be77c271d459fc7608a443725a242c9c52c00f6f4e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\unicodedata.pyd

Filesize
1.1MB

MD5
5753efb74fcb02a31a662d9d47a04754

SHA1
e7bf5ea3a235b6b661bf6d838e0067db0db0c5f4

SHA256
9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72

SHA512
86372016c3b43bfb85e0d818ab02a471796cfad6d370f88f54957dfc18a874a20428a7a142fcd5a2ecd4a61f047321976af736185896372ac8fd8ca4131f3514

Download Submit
C:\Users\Admin\AppData\Local\Temp\manifest.json

Filesize
163KB

MD5
ebdb151d6cf0ea702d54353a314ddc1f

SHA1
59bc326ea3f26cdbee57b415fb9f6b7c59ee2836

SHA256
6cccd9754c86d593aa7597eec7ea270b513fb2eb263d79f7d6729b465b187e70

SHA512
656d53836a6f40dae79c65c5a62e45f849351102a5f8f5eb7994b42ce26e8eea3372631e06e1a210c31cfb74a4b3cc94307739f9866b50e7a2bc996f239e9558

Download Submit
C:\Users\Admin\AppData\Local\Temp\versions\1.20.4\version.json

Filesize
34KB

MD5
687b5fc8d9af27deb560334faeb2ea37

SHA1
3730cb8ba42bd31ca9c7805fd43dbb746c095bc1

SHA256
edaece3cabe6e9fb5ab37706290d3ab618e746f74a5a8ce18e1d8fe03a563a36

SHA512
7eef19b29720aefdb72aa964303f6853ab22d65e3a8c1b1131d2dc373f9a299a7bcb13005f8ee691c324418a3a7b9f78904bb54dff181bd0c3fb970eeb243997

Download Submit
memory/4584-91-0x0000022C1EAD0000-0x0000022C1FAD0000-memory.dmp

Filesize
16.0MB

Download
memory/4584-99-0x0000022C1D1E0000-0x0000022C1D1E1000-memory.dmp

Filesize
4KB

Download