Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/04/2024, 18:51
General
-
Target
OTP Bypasser v1/login.exe
-
Size
48.9MB
-
MD5
3f021a743dfffaf6339507e764e11852
-
SHA1
4a95d0a84fb633a715ff0db83c9b56db5a592a70
-
SHA256
faeb443e13fda78ba26820c2be59d32ee1d7d59c0a9ead6978d2e113bcd25461
-
SHA512
541eb6d6a8552947c552a20072292ce8c9c106b91b3e0ad6062b47a444d53e4b77ec4f9fbc173f32b3d5da88a5b0a7aaa4a25cd2ddb8f61c5ec816e8d5ddc9aa
-
SSDEEP
393216:C94n6eQnJVgetJBRrnlPSa7KvMwGs4zGbdd7BRo:C9mQtrnlxmUNcL7v
Malware Config
Signatures
-
Loads dropped DLL 50 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OTP Bypasser v1\login.exe"C:\Users\Admin\AppData\Local\Temp\OTP Bypasser v1\login.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OTP Bypasser v1\login.exe"C:\Users\Admin\AppData\Local\Temp\OTP Bypasser v1\login.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD58b91cbed6ac3fa4923f5697f05ed97f2
SHA1faf3831b3d0e6b4e8bd77c32d0f54dc81716355e
SHA2568ebfaaa53f983fa91c3026f60b8ab7726bc9a87ffea051912b29e198059b0195
SHA512f781828bcbd00d0461f351fb4b55db17f196daa885d941d57fea8f5fcacb491c98c402bfacdd8428eb8d9a3d285b6199a041a0db656e6a05a7fcba3cf98e0065
-
Filesize
9KB
MD5cd36c260939cb034764269802200741e
SHA1d6c7bd39b5a6707705ffc5a96a2733ce9eaa62df
SHA25699c291ab394386e2e9c54fffbb7bb42dd4ae0d2fbd5db849dd58e3a0de0c4ce7
SHA512eb84431b23633cf8c3889686dc5eb69d245f9083ca3ab94d70c781700a95c82fd770e522e695f7d405c2e970226f461730ecbb8df7caee7e8f153f4859637197
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
36KB
MD55ff77e9413f0483604e5b9b3ca0f175d
SHA19cfa43efd00e79c315431e136b9e63dd04f4b158
SHA2561f2806be3b9b7e737c28dd45f16fea03df6270212673ff89f0176a14521bc9c1
SHA51272d3fa4d4b790430418090b6ed6133eb7863b3f2764ffc9ddb572bc4e7ba78a5a331113ce5584660171afcd52feabeec81beaef0bcca42a076740d68907cc130
-
Filesize
48KB
MD521cb27fedcc4de2f53666cf01fefe368
SHA19f2e412e6d42b1620a36e76e10871b71013aa91f
SHA256c040731abf810446d674c4bb809028b43ad86414c759c7d766d96e044a90e6d2
SHA512d22b3b44414f1a5dfa5b9db53e629746b540053d9fbdf1779cffefb35fc5a363ca591baae392b332818433687480cba9e652d0a84190b080b1db32b39e2ca3a5
-
Filesize
71KB
MD5c1cd1d53ddfe5033a341f0c2051c4357
SHA1b205344ada67dc82d208baf2d6b9cda4a497abea
SHA25644381ffef40a5e344ca951de08f13fb4e25096c240d965acfaa47221b9f9ef52
SHA512d4f509cfb8fa1f044ff4b0b55c5298ead40fd635cfb5a6c7d779a66eeb5f52d3e30a5b3e61507f2891e9ef1070e0c8eea1b698b680048fbb7cb5f15f4e26d309
-
Filesize
58KB
MD58ff8db4ecc9885f1c0889bd4616608c0
SHA11eb00f4e53c09af4929a22829d8e3f29d5c7f963
SHA2569a3e07523e3a4ae414cd3d4fc5aa86c78bcdecb21e250f8e8a7159b9b489902f
SHA51284b2cea1ddf2eacda7df0813748f3170821feea3e810bfaf640cc6e9e8cd7cbdb03c333e5e42e5a08897d5eff0174e3ade6c184b6c22ddbf29bd95f4c0b0eb7d
-
Filesize
106KB
MD5f9eced06c96bfbc09faece551988d1a8
SHA1e3ca94c34be0e3245fa45044b66e1d4685740566
SHA25628de6430fa48dad3793ee37c1d12e1b41ba64e6e2fa3cf9e0ebcfecc8f43d6a0
SHA51222022343c23fc9b259645efaadffd405cca042dfd72e6007abd5c578260186ce203b830207b21b265419ee3f7fffacc4ff579fec2cdcc0a0134e1ef40a3ef40d
-
Filesize
35KB
MD57098d4e1317e2370fc36c720b5b80ab4
SHA151f7315afe7e924d359fdd0ae78653ea639fffba
SHA256845da5608d2cf3cb57e179d690eebad6dcc92a4bca6406d606263420bf506126
SHA51247f1c2dde6cd05c0782b51d70e6ff02a02ea0d86bd90054172bd5a31276e8c191efeb3cb45123f8d35bc8e3e3ef41ad6bd18306a3de5b9233dea6c61c852d53a
-
Filesize
85KB
MD56f714e4cc605ea1600e99f88a5615dda
SHA1c1d807d0ee104c7db4f6ea469784eac4162c392c
SHA2567fd353258f3489997a536f95ff019ebb5465ca27eeafd06c0a9aadf171124406
SHA51204c79ad75845e528a12c98764738831b6a20ea4843210dd9df3238212d20d707135a4e2eb393ff896b59fa4e075366275b6a2eef256557e961ba8e7336050a4e
-
Filesize
26KB
MD5e60e025bf78e850f8da00012692a26fe
SHA166fd8f7f1333e063b1a8603dbc684aac1df76a18
SHA2567b6c6cee90f6f8ddc75cd67e87d684d2c99e17db25cba46e9078d2bd75fd98bd
SHA5120f2bef61c3967ef3e819865614096073e8cd8c04112190c12747a1023906690ac3aee2e848e2e437ddec25ecae016d47beddbd88173c29ea89ce49289b342b65
-
Filesize
32KB
MD59a17f8dc38e17dfb75e615a7446f8235
SHA1624af6518784c11cfc673ed97afdfd73f5123b09
SHA256eb2b27480aad9903fce24e5b842eae7a8645f986964323ff3f5aba546d4e5568
SHA512b5deb85353aa93d6a86c1935dbeb4697cf3064d38d60a49829f9b07ec26db4e66a2d21eecf54fb593c7118c5ad9f34af84843032c29365f9a6d7452e104295ec
-
Filesize
25KB
MD544ca74d70a9268a0ea6175c269b70e67
SHA1d25c0942852b7285eeb386857ab6ee5b9f92e1c5
SHA25661b8a7284f12288bd412a5e73c632efb628ef69be0b81abb296ac4512b78cb36
SHA512b9de2e4135abf1c1f3b1e3d5cd5d3480124c84b88e40a8e51132d8a961bec318d2945cc39cfd58b8f0b1e0f2abd4c602b1910ec2d513beff72c64ee02b967f8b
-
Filesize
43KB
MD565f11e56f08524f39643ce222bbb61f3
SHA1f45d6be5da04f2037b39fd44b452f96735cbb720
SHA256ba6d83e2e12bc312b597bfa72bffa222f9f20975c0cebc810b849aa3dbc1e830
SHA51211cdb154773e7730c38d4ec5a2b51975d678c7b0f98f167fd297b518d6137a6d20fa4aaa7a9c954b30817275bc3085c04103043a32c635c84d1e9b3803c59f5c
-
Filesize
56KB
MD514eed44097ee2ca2ff4cca2e5c2d86f4
SHA141ac5b5d7448b79e23126cc29e002d12f96046c5
SHA256fce480d832a741815bc61f64eea7ec76374583c60854fe9a19e43f6b6e5eb01b
SHA51255f6abc9da4f59c45ece1e2ad2f068d357c67b4536ffff6e916e6e0fc860f593ef7f7d2d183cb4220ceb967fa6f7179b396ac6eb3d16d673f1ef3152adfceee4
-
Filesize
62KB
MD571ac807921950e36cdd44ef06ffd8fea
SHA11acbdbac63fa0906d646cee068ed207940f2cc94
SHA2563a34f917b70af1f91aecce21b0fd357d982b88239d52844f939f76fd37daf6dc
SHA51256dd7dc5e0febd01a403956b7fe7ad9b07f1f0c1e72be87b9ebe6ed20742c85f23ccbbcbbe941ae98b16649137dcdc937925d1e188ad8d02e6a510c3c53a5d23
-
Filesize
24KB
MD5a16b1acfdaadc7bb4f6ddf17659a8d12
SHA1482982d623d88627c447f96703e4d166f9e51db4
SHA2568af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0
SHA51203d65f37efc6aba325109b5a982be71380210d41dbf8c068d6a994228888d805adac1264851cc6f378e61c3aff1485cc6c059e83218b239397eda0cec87bd533
-
Filesize
1.4MB
MD52efeab81308c47666dfffc980b9fe559
SHA18fbb7bbdb97e888220df45cc5732595961dbe067
SHA256a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
SHA51239b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c
-
Filesize
9KB
MD53275f09e1d0e6b62848142457e500909
SHA1a7d85bc1b3edd7cf26c88c5730105788702fe260
SHA256cce797bfba0afdac27705a11f04427092c5c9f5ea14b7da329c2b76904ff3e2f
SHA5126651c3c2cf301d885f1821c8b626b13f723f3b3936d99785ad84b9ea2779115c724cfcae9ed1ec87589719779d971a692c4034c9e149108b493de930f395286c
-
Filesize
39KB
MD54261454f3bd706539298b0cf68f4fc74
SHA1d1a3e574fe1fa93e7b3d2ff73198c62036b9ccec
SHA2569ffc8239c0c136b090ab7bf16590198151aa5fd66a24f063bc9949bc9c213a93
SHA512e71077f6559d110cefe4a3c034dda3c16208fdaafd8598a41f4175f26c31cd8592df76228f2c3fe97cf368854aa463e5e64f254b9291df0e7717c5ad28fe22fd
-
Filesize
1.1MB
MD59086b4c10d41c366584ac2630725184c
SHA1656e134dd2e55fc6ab16c2d22f6ccdd120ca638b
SHA2561daf632226d071963d5403755040f8844924d85140b6e41991332dd96384e746
SHA512ef72d880ad3f451a0bb4160357be0f02d111e20129f2aed79c23bbf823cbd168b3762c4cd980a2f292c9aa0d112475a3c28c62891ae29ab788f3e1ab55264e93
-
Filesize
27KB
MD5be01c862e7b04ebe902ec6149b45e370
SHA1c1c97ab0973e91cd0d0d702cbf454c9c1b8551a7
SHA2563341bd31f32db4cb9ead13b14667b4f47e757860fcadf93157827311d1548e86
SHA5120d90fa42b355cdf2e781b7afcde59cd70d47bcb0db15d98227af0d6a8973ae6ed1fb56a70cd70f6e5891399015953576256f9be3b7953ac964d61138139d681b
-
Filesize
203KB
MD59a8c68f00a04b7c2efb0197c93db1c8a
SHA181a1342910c50ab64bfc77c8f25b1fc71b2348cf
SHA2567b3027da7a291061c9e8ec1a7a0cc2a883680258893b44620861c0b7c2bb180d
SHA51201fe96da6c63744941dd5d182af951742b23aa3560f228dcb16ba7887183ef73a60b09cee5d858ce237d2f15397db04685ff94c3c3e7ca8904fc70645e8eeb59
-
Filesize
31KB
MD564c303e4788d23039d4981849d655b2e
SHA1311f70607eb3ccf85f4c2c7e04d8188b9280fef6
SHA25661e07823df608062f8223942eecb8415eaa1ad15e2783c95657cf749840d8ce9
SHA512094db4655e5c7873011f7c37be1a6bb414bef48df39d846d15b6f2811ac8a9fd91d678153c3652099343d4d2832cb459a2bc4596160df9b15d62521fa52755bc
-
Filesize
87KB
MD54fef96c0187aa714122fab30ec3c9e51
SHA173a95ae5849f24aef8d076e3219741e018048ac5
SHA2569e14bde14993f6009807a80f54b9c79ce488134876b721a64c762737f6754054
SHA512b9bc02da13d08c930a8a221db288575943b7f2cbdf0fb213f85f38f0814fc9632d9877b24a746e9f734fb7baef788a3c4ac95e40bace618d3a1d6c0beb672cda
-
Filesize
65KB
MD52ad3039bd03669f99e948f449d9f778b
SHA1dae8f661990c57adb171667b9206c8d84c50ecad
SHA256852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
SHA5128ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0
-
Filesize
1.6MB
MD593fbda093dcc8b7ce3bca1411757d7d8
SHA125c5035659aeb647fb7c5d9b82dd49dd685504c2
SHA256233f4666110f88447382dc4726bd85161e749c6a0f77145e59018d24fd0e0eb5
SHA512f4d7729897449ca2147cb92fc5bd4130279d4008c6c1a77f37110aa85c5bcf010995858a828e22a4633db8eda40586c53f504874b6205040ad5cb1df130e9f82
-
Filesize
193KB
MD56aeb23912e08d018d7f32a28127e5494
SHA127e6c869b7b24757f7cb18ee2925d5e74024e8e2
SHA256e1e3b7040846de45406e96585fc2baaca1853efcdf4fd402909a0b7f78d1ed7a
SHA5124c24dae64a49b11af61882570607ad7d14ac794799904951221bf5c82b503768d018d13e24d1c66f70a43d0d900c596d60870eb26244812191a1d1ed36ba469e
-
Filesize
62KB
MD551771d430061cf437733c45dd877d20d
SHA156d61b080e7c943978a43af77fef30c21d7b7455
SHA25679e3a80f9d6a44d7cb466b51e6e23a862d8c1908a0cb32f9996ea6ebbfc12aa8
SHA5123b30cfff85157167af8c6eb3d83547f03c9cea93fe796243451484a2f74b510fd8246639832cbb286be0019295e1a575dd69543b956393cac5b953ee52882de2
-
Filesize
25KB
MD54c411e358d97fd7061fb5770c40f8d7f
SHA1c0aa12710b3287f1cd57bb922a0457d3e8e5930b
SHA2560d6f699bd8b4f1736304fe9ec1fb16d619941c84803034f231ccac09357f4bbc
SHA512612ee3989237d0a6dba7655f6eaccc871687f54adf91f461718d779b678e269da7bd2b398648a3840c08d285eccdd4d9194a0d677da805eeadd9ad93522960ae
-
Filesize
607KB
MD53905f56150681412d25204552743ed20
SHA19a041c3575bf716aa5ba1061891404b9eb1dabc6
SHA25687c3084b402f34ff3b8dc57f227ea21f4c2cf8485b3624b988246f65f189794b
SHA512d39a1e94a9aa402150737e69ce33c1dfa79154a540abcfff427d2efcfd7c6ad95bb0e2b5c6d83ed3b154d4acb3bbc007a5739fd911f69d1c3ebc09842dcca8cd
-
Filesize
295KB
MD5d6dc5d416136ab3945b7acda121179ab
SHA147a1e13de084a13ad12bd371e5197e8f63aac9ea
SHA2569b8f229cc0a1da692e10a47a6ca3438a30b1884497a1b58d45c617667bd8a9ee
SHA512e1dbd3f6ea87750d520bed5b30fb242052e577f220fee24b37bf80f7ac6e7626d1f11285bf21a98a035fa493b14543315095e4253014051e1837eb00916b01ea
-
Filesize
48KB
MD5d054b5a8a6f8cbcb6e3d339cc5b4fe97
SHA1410c291809844c411324b5935b3dd11b1a718fe4
SHA25603d2f3a3a0ed71a3a929c44aa6cd3cbd6543e9c1a490aa1ce079dacff7f7dfe5
SHA512004b51f3c11a2571fa62f8d8601351f8529125c5e5b2ebcd816aa5295c2d0b133edad7778d7f22d722e6f8a5e09391ae4e37eb5dfb86887cb7ba322b75ed686b
-
Filesize
736KB
-
Filesize
48KB
-
Filesize
752KB
-
Filesize
212KB
-
Filesize
184KB
-
Filesize
172KB
-
Filesize
100KB
-
Filesize
184KB
-
Filesize
3.5MB
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
72KB
-
Filesize
180KB
-
Filesize
80KB
-
Filesize
60KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
1.4MB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
5.9MB
-
Filesize
96KB
-
Filesize
5.9MB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
224KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
56KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
52KB
-
Filesize
2.5MB
-
Filesize
164KB
-
Filesize
72KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
5.9MB
-
Filesize
140KB
-
Filesize
180KB
-
Filesize
60KB
-
Filesize
52KB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
212KB
-
Filesize
752KB
-
Filesize
184KB
-
Filesize
172KB
-
Filesize
100KB
-
Filesize
184KB
-
Filesize
3.5MB
-
Filesize
736KB
-
Filesize
84KB
-
Filesize
1.4MB
-
Filesize
140KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
80KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
224KB
-
Filesize
44KB
-
Filesize
2.5MB
-
Filesize
164KB