Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-03-2024 17:12

General

  • Target

    de86442b91c0d5916aee6ff4d5a209f8.exe

  • Size

    15.5MB

  • MD5

    de86442b91c0d5916aee6ff4d5a209f8

  • SHA1

    3485cc4984a27169d3bbc3c6eec2e6a60b22cf2b

  • SHA256

    1e2bb72289120337ec524dde9f9e5924c33820004ceef2bff6a762dea92a6470

  • SHA512

    0a388c760c552795cd3efbf496d31adcee3faad009e8810bb9edbedce4bf54b847578919d1f3663c59425f51738e5b5cf1a67b9a6db15ddc40b3c26a54b7205f

  • SSDEEP

    393216:+3l/UkWJHlh2phoyMxtDDAxxfT7zhNsLuAHupHeAgyhYC:+1/J+FQphoy2ALzAHuBm

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 32 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de86442b91c0d5916aee6ff4d5a209f8.exe
    "C:\Users\Admin\AppData\Local\Temp\de86442b91c0d5916aee6ff4d5a209f8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\de86442b91c0d5916aee6ff4d5a209f8.exe
      "C:\Users\Admin\AppData\Local\Temp\de86442b91c0d5916aee6ff4d5a209f8.exe"
      2⤵
      • Loads dropped DLL
      PID:5036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\MSVCP140.dll

    Filesize

    613KB

    MD5

    c1b066f9e3e2f3a6785161a8c7e0346a

    SHA1

    8b3b943e79c40bc81fdac1e038a276d034bbe812

    SHA256

    99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

    SHA512

    36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\PIL\_imaging.cp38-win_amd64.pyd

    Filesize

    3.0MB

    MD5

    ffdd9744d171a86638e8ee8119e3c094

    SHA1

    fd9624b40958f37ffbaaed3742f515fbe36afedb

    SHA256

    acaaf709b91fb90574ec92d2563fd0d88ee52b412023da5b7c8d83385cbbc03d

    SHA512

    db7e2f7ef29b63d9c001809d3096a9ebda0df506786a781de75b22e05e78c86ffa2839872c3f581eb855676d67e1a437f523d00bd56b5416ca7a48ef33ddb957

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\VCRUNTIME140.dll

    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_asyncio.pyd

    Filesize

    62KB

    MD5

    fe9322e00324b59c179d4c9803322b6c

    SHA1

    4d27aa7b1d38ee633de49256bb26a9ee47eb9ef1

    SHA256

    46967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb

    SHA512

    29d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_bz2.pyd

    Filesize

    82KB

    MD5

    3dc8af67e6ee06af9eec52fe985a7633

    SHA1

    1451b8c598348a0c0e50afc0ec91513c46fe3af6

    SHA256

    c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

    SHA512

    da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_ctypes.pyd

    Filesize

    120KB

    MD5

    f1e33a8f6f91c2ed93dc5049dd50d7b8

    SHA1

    23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

    SHA256

    9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

    SHA512

    229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_hashlib.pyd

    Filesize

    44KB

    MD5

    a6448bc5e5da21a222de164823add45c

    SHA1

    6c26eb949d7eb97d19e42559b2e3713d7629f2f9

    SHA256

    3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

    SHA512

    a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_lzma.pyd

    Filesize

    246KB

    MD5

    37057c92f50391d0751f2c1d7ad25b02

    SHA1

    a43c6835b11621663fa251da421be58d143d2afb

    SHA256

    9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

    SHA512

    953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_overlapped.pyd

    Filesize

    44KB

    MD5

    1b04bd84bdd90b8419e2a658a1cacc6e

    SHA1

    c016487aa0455a8bb664f306fb4ad3e7e64811f2

    SHA256

    44f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4

    SHA512

    24e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_queue.pyd

    Filesize

    27KB

    MD5

    44b72e0ad8d1e1ec3d8722088b48c3c5

    SHA1

    e0f41bf85978dd8f5abb0112c26322b72c0d7770

    SHA256

    4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

    SHA512

    05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_socket.pyd

    Filesize

    77KB

    MD5

    d6bae4b430f349ab42553dc738699f0e

    SHA1

    7e5efc958e189c117eccef39ec16ebf00e7645a9

    SHA256

    587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

    SHA512

    a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_sqlite3.pyd

    Filesize

    85KB

    MD5

    d2e7ccc8bd1aba0b268ee72577548bcd

    SHA1

    f7a1d15d23348e4d7f1c94769c84923e94d16ac6

    SHA256

    75db26ab9dc51d765d1d98dca63f57a801796ee19fdb87e62be518937584015f

    SHA512

    61d7445d007a176d6a202971d608031cbdf0e1a31fc4be67e85181d3247934f90f24c1954710ecf9c135e90326171bfd210b3f30f22332a7ee898ce5f8e08dc9

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\_ssl.pyd

    Filesize

    115KB

    MD5

    8ee827f2fe931163f078acdc97107b64

    SHA1

    149bb536f3492bc59bd7071a3da7d1f974860641

    SHA256

    eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

    SHA512

    a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\aiohttp\_frozenlist.cp38-win_amd64.pyd

    Filesize

    62KB

    MD5

    fc8a220585322021416cfc4bce9a9697

    SHA1

    76c9ab2cc8ae23e091baf4ae52a5ff1d0668a683

    SHA256

    5440e7d58e44d2cca5764b6e282da61c63990b5ef116d3c728909d55104a09a7

    SHA512

    c11785ac0b34492d69b45da3d3e489d819be28ff0f34f00bb6825934b74f94cdbe2f548eddd9c5d54dbba5f2664835b56323dc2d8159f04beb1552c072e96e4d

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\aiohttp\_helpers.cp38-win_amd64.pyd

    Filesize

    47KB

    MD5

    5bf893cde770aa22603f7d2ac1371c0d

    SHA1

    41f75dfa82550c84acc0e0efec53a921140842d3

    SHA256

    7ca04ff9661acf7bffcb3e557b0d82f12574c499d2c5b213d92b77afc43e17be

    SHA512

    c79d41b568ef52bcfe2555f1a6dd74ae8251dd984ecb03b9ecc35a8e2c8f84f2cd994d156b1df81a823c8f7fb1446989cc60182fb2b382ee217be258d52d9c16

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\aiohttp\_http_parser.cp38-win_amd64.pyd

    Filesize

    232KB

    MD5

    ac91ecd48574ce412e8e4d485df4ec77

    SHA1

    676a9bcf343e13e925f86cc6ae3dcb37e12885e8

    SHA256

    886115744bbd68d7d1406f8ce3bd8a6c51d86bd6c7ed760a8540baad9112ea4b

    SHA512

    8b11b6b403d0ebc9736dd2927a6318261cc626509a8b1ef946b89a81d0e9e8b1c9f05444a8d2ed6076c5cec9c38e9f03bb3d0e7ead7c871252c77b951dcb8498

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\aiohttp\_http_writer.cp38-win_amd64.pyd

    Filesize

    41KB

    MD5

    cdd7e78befd976319921ad58e871b026

    SHA1

    28b56d22e52cd2842504ea999a17c96e075313c9

    SHA256

    ad13169f77b799492f4051158997bdf9bca5a52eb1c834e9b385c60cc5619dcb

    SHA512

    1ba3ee6f535cfb67c9ea618db2841c1afa99a2893f93a240e28f57a5f225a868653bcb929077ff9eb42e7733c1320663d009e6bca70883ee857ab721943f0e19

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\aiohttp\_websocket.cp38-win_amd64.pyd

    Filesize

    28KB

    MD5

    9a6c957ffd7186ad86bdf823a416975e

    SHA1

    b269925b19f7c4b87bc2f2eecbc17d981c7ef98d

    SHA256

    9723dd25eff1cbf3d5d2da25604a2bebacd2476b38c2872aeaf3b6a3403a584e

    SHA512

    6e35dbed54a68f33999a20e18715d44420c3a21f05f85b0f465f3275729047335759467e16f9d757b1ea166e4736df98bea56cb58b7721d36f70e7d7f9872466

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\base_library.zip

    Filesize

    758KB

    MD5

    802121028264cd071827a5ab62552092

    SHA1

    d622736c78fc64d6a1d3ca81572acacf06727cbc

    SHA256

    2f276b628f11077b78a78dd82df94eab300e68e562d3daa9a743458db0b3d047

    SHA512

    d4d77c2aa497aeef1e70dc82376e699b036c690c5ab78a2274ab5f943e1966109069c6b52b89586fb770387be88dcccc38e16df3dff1d94bfab5497e1f716ac7

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\certifi\cacert.pem

    Filesize

    253KB

    MD5

    3dcd08b803fbb28231e18b5d1eef4258

    SHA1

    b81ea40b943cd8a0c341f3a13e5bc05090b5a72a

    SHA256

    de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e

    SHA512

    9cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    bf83f8ad60cb9db462ce62c73208a30d

    SHA1

    f1bc7dbc1e5b00426a51878719196d78981674c4

    SHA256

    012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

    SHA512

    ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\libffi-7.dll

    Filesize

    32KB

    MD5

    4424baf6ed5340df85482fa82b857b03

    SHA1

    181b641bf21c810a486f855864cd4b8967c24c44

    SHA256

    8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

    SHA512

    8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\libssl-1_1.dll

    Filesize

    670KB

    MD5

    fe1f3632af98e7b7a2799e3973ba03cf

    SHA1

    353c7382e2de3ccdd2a4911e9e158e7c78648496

    SHA256

    1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

    SHA512

    a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\multidict\_multidict.cp38-win_amd64.pyd

    Filesize

    43KB

    MD5

    c43c2103add8c6c30f25b9e46e086147

    SHA1

    7a04d0dafcbe1036033c99d3e796422cba382796

    SHA256

    d31834c5ba38b1654ccecdad6423d2c15fe58593f2dfba291ca0753e5ad2f8ce

    SHA512

    b1d4f101543b1788c0e6137ff8c32b362082174618dc0ef888c692bde0fa54c182e4e2d8b7137e7cb20c1621336bc388aff6f88015ce4714c11254c10462e9bc

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\pyexpat.pyd

    Filesize

    185KB

    MD5

    e684792507faf113474a6d1217aeeaad

    SHA1

    f9486048ec025a9f469f52c1788a74e70975b431

    SHA256

    1035c85c840c1007d5f5bb62ca7358d6c85b5e4bf15155fe0857c6a17453f18a

    SHA512

    1a50bc231963d405f25879ee3560eb90f7b18d51640b9b4d848f18caa9fef14907f8935a86f093478be0ee0e1261e4bcc8c697b486bc0617c5f77370337d48c3

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\python38.dll

    Filesize

    4.0MB

    MD5

    d2a8a5e7380d5f4716016777818a32c5

    SHA1

    fb12f31d1d0758fe3e056875461186056121ed0c

    SHA256

    59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

    SHA512

    ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\pythoncom38.dll

    Filesize

    560KB

    MD5

    efd05544ac3a7f0c7e38223004c1b81a

    SHA1

    2973a5c4d2d118fe66b6591455a90c33811ef3cd

    SHA256

    b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b

    SHA512

    3a25385ace2ca903df5bf9e04befdefa84fc325c53c379bf658df8033ac07bbf1a4ae7d216b77bb6b1f94bd8f99417d5d052d89f63f80250fb7cc6a91a05ba4a

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\pywintypes38.dll

    Filesize

    141KB

    MD5

    d273b6494c4761536d6eef26e01956f1

    SHA1

    a6e65c6745a593a23b20cbe9b8ba3414e46e50bb

    SHA256

    28680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6

    SHA512

    65db50b36c8b1d1285e1659e1a67dd02329eac330192609a247057b535053571251f450865a9ccf3c86f23d2017b6950d68108c7171bf840f07958b39a034ae5

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\select.pyd

    Filesize

    26KB

    MD5

    6ae54d103866aad6f58e119d27552131

    SHA1

    bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

    SHA256

    63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

    SHA512

    ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\sqlite3.dll

    Filesize

    1.2MB

    MD5

    6695408dcb79890ed16b7491ba07ea3b

    SHA1

    07fdf0d4d167b5893853b71c54df1dce313503ad

    SHA256

    f2e7a0cbfaaaa597d68b923a5360669ab3cd9e643fabdab2aba7c6da91f2b5cb

    SHA512

    12c04eae6771c6a7878034b40deb19c843cfa0438c20fdd5099195d8e12ba9bc64fdc7e367353b08a2ff0788c67eb8b16521918df5a1e133863a44f02de01818

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\unicodedata.pyd

    Filesize

    1.0MB

    MD5

    4c0d43f1a31e76255cb592bb616683e7

    SHA1

    0a9f3d77a6e064baebacacc780701117f09169ad

    SHA256

    0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

    SHA512

    b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\win32api.pyd

    Filesize

    132KB

    MD5

    701d49790343f77b9cc78033f47772b7

    SHA1

    7f9031b27c30fe9b5a7432bd92505bcd5fcaf600

    SHA256

    e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257

    SHA512

    c15e89bcd6e9bd12d31514b1110a6347c0fc1809c6dfeb711f08a7ca51d19b3a7db856f0e1240d953bc8316f2066bbe1f012f588a7a925f98d29a991f8c40620

  • C:\Users\Admin\AppData\Local\Temp\_MEI49682\yarl\_quoting_c.cp38-win_amd64.pyd

    Filesize

    78KB

    MD5

    e96e99fc84249de9c4cd4649f3a27f7b

    SHA1

    4fcf885311d24a2ce438842bb7db269550709a00

    SHA256

    3730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303

    SHA512

    19aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79