dcdf03a4f596d8472aeb7817ec98a84b2b407abb57c40ac292e4a9da1659ad5b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

@STD_WOMGame.exe
Size

11.0MB
MD5

4b7f0bb933d320e888971d735c505165
SHA1

55a8b7e9efc693e187a30e8a2ea0f36104b07fff
SHA256

dcdf03a4f596d8472aeb7817ec98a84b2b407abb57c40ac292e4a9da1659ad5b
SHA512

42be671198704fc11c7a5d15cc08965b779c67321436772927b1515f09f38c75c03711734a7420de586a1f419ba3933be440c3f96a541449e67f3088044d4e10
SSDEEP

196608:z/Zv5m73JoP1HOXfZ8bnt0gBF7x/A1PTv0T4G1dVSKzm/guPC6WkSSFY5cJCuk:zhv5m6P1IR8JrxodTvAVSKzmS6Wt5gC

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2596	@STD_WOMGame.exe
2596	@STD_WOMGame.exe
2596	@STD_WOMGame.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	2596	@STD_WOMGame.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2596	1660	@STD_WOMGame.exe	28
PID 1660 wrote to memory of 2596	1660	@STD_WOMGame.exe	28
PID 1660 wrote to memory of 2596	1660	@STD_WOMGame.exe	28
PID 1660 wrote to memory of 2596	1660	@STD_WOMGame.exe	28

C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe
"C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe
  "C:\Users\Admin\AppData\Local\Temp\@STD_WOMGame.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16602\BSR.exe.manifest

Filesize
1KB

MD5
01bdde983c4747e5576351e061fd7c19

SHA1
f961f3ee46babe14ba1e39bd52c13b3d14db9305

SHA256
34e6001975dc7e2dd8533a7e23b5bccaea3c8da6dac3e3292fb0d891fd6af81f

SHA512
0c85aed2bad807dd4a3b080e8d815353c3d0f57a3fb6f5fbf7c9215e60256f0e357482cf8c3a672a638bac0b2459907493aa7e338f61fcb9a3feb254e9389c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16602\VCRUNTIME140.dll

Filesize
81KB

MD5
aeab74db6bc6c914997f1a8a9ff013ec

SHA1
6b717f23227d158d6aa566498c438b8f305a29b5

SHA256
18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

SHA512
a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16602\base_library.zip

Filesize
763KB

MD5
ed5693db3c4b5bae528fedfbbd6c2f5c

SHA1
9280745fd41919c5481222e0befcdeb96e64b15e

SHA256
55af9a743d986aa7e42b8e51e44a91685b4b7320430e8488e2c0893841e8dd4a

SHA512
1739fa335d55211ee32a7da4ad61fe6ac505830fd200914a5ca70f27c5d379bd17c3670b91d14be9ccb8744579ef401ce0b8fdea80770d6f1cdf3b90a90ccbdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16602\python37.dll

Filesize
2.0MB

MD5
b0e24e405ca41742bf070daf80ccbd28

SHA1
b997aaef1cad509b66ef39f8bc217f85ac53c06a

SHA256
d8f5504cf321a3e55939b66b390eda355babf08fbc30166fb93d67e90cd5fa7d

SHA512
5a4f2740874fa138dd912b2839cdc2785b795812e7b40473f9fb2d2de08d490ded4362c41cc44416b58de3c82d4956114b4047513649f1b8ede44b818a4732bd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI16602\_ctypes.pyd

Filesize
102KB

MD5
10861d3fa19d7dc3b41eb6f837340782

SHA1
b258d223b444ab994ec2fec95acaa9f82dc3938c

SHA256
6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1

SHA512
ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI16602\python37.dll

Filesize
1.9MB

MD5
f85d56f5932f32677eff9b2d64687e5c

SHA1
d2a93f5f06691c004c5a6d6f5f2d4ea2987aaff1

SHA256
05bb5a38f657f6f2836336eaa057d6a72d475b54eade0a8e7f937b5c4fae2c6a

SHA512
f75086a657998c218148bf32511a19af6e2b775fcaa8923fa2ed3b85d9e880c0de8afdc9825ef72ce612b92c63ab2019ebef3cd94472da7ec6cb1266b1321c2f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads