Resubmissions

19-04-2024 21:02

240419-zvpyxagc41 7

19-04-2024 20:57

240419-zrrckafd46 7

19-04-2024 20:56

240419-zrfaasgb5x 7

19-04-2024 20:56

240419-zq62mafd29 7

19-04-2024 20:51

240419-znmj7sfc45 7

19-04-2024 20:47

240419-zk4djsfh81 7

19-04-2024 20:43

240419-zhnkbafa84 7

19-04-2024 20:39

240419-zfd8vseh95 7

Analysis

  • max time kernel
    195s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 20:57

General

  • Target

    promo-link-gen-midquality/promo-generator.exe

  • Size

    6.7MB

  • MD5

    3fb118c482b086b4fbc35fa36401fe69

  • SHA1

    f29ed82b70920b3d078a81e39c2a607ec4c468ae

  • SHA256

    d1c9d977172049ccebf014477581e9ae879a4a925869bdaf3c68169ddac0968d

  • SHA512

    939c63894d8abcd1c883c43375548b500a3ae34c798e97207878b01afbeaa9bccc53a63f53d108a6b8459593e122cda18864962d1f6838b95c425a8356eab4de

  • SSDEEP

    196608:+n9v8Zk3DdQmR8dA6ly8Qnf2ODjMnGydS8lwSYkZ:mqkzdQJl6F3MnG38lwSYS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\promo-link-gen-midquality\promo-generator.exe
    "C:\Users\Admin\AppData\Local\Temp\promo-link-gen-midquality\promo-generator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Users\Admin\AppData\Local\Temp\promo-link-gen-midquality\promo-generator.exe
      "C:\Users\Admin\AppData\Local\Temp\promo-link-gen-midquality\promo-generator.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:2688
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:812

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\VCRUNTIME140.dll
        Filesize

        96KB

        MD5

        f12681a472b9dd04a812e16096514974

        SHA1

        6fd102eb3e0b0e6eef08118d71f28702d1a9067c

        SHA256

        d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

        SHA512

        7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_bz2.pyd
        Filesize

        81KB

        MD5

        4101128e19134a4733028cfaafc2f3bb

        SHA1

        66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

        SHA256

        5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

        SHA512

        4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_ctypes.pyd
        Filesize

        120KB

        MD5

        6a9ca97c039d9bbb7abf40b53c851198

        SHA1

        01bcbd134a76ccd4f3badb5f4056abedcff60734

        SHA256

        e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

        SHA512

        dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_decimal.pyd
        Filesize

        245KB

        MD5

        d47e6acf09ead5774d5b471ab3ab96ff

        SHA1

        64ce9b5d5f07395935df95d4a0f06760319224a2

        SHA256

        d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e

        SHA512

        52e132ce94f21fa253fed4cf1f67e8d4423d8c30224f961296ee9f64e2c9f4f7064d4c8405cd3bb67d3cf880fe4c21ab202fa8cf677e3b4dad1be6929dbda4e2

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_hashlib.pyd
        Filesize

        62KB

        MD5

        de4d104ea13b70c093b07219d2eff6cb

        SHA1

        83daf591c049f977879e5114c5fea9bbbfa0ad7b

        SHA256

        39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e

        SHA512

        567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_lzma.pyd
        Filesize

        154KB

        MD5

        337b0e65a856568778e25660f77bc80a

        SHA1

        4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

        SHA256

        613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

        SHA512

        19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_socket.pyd
        Filesize

        76KB

        MD5

        8140bdc5803a4893509f0e39b67158ce

        SHA1

        653cc1c82ba6240b0186623724aec3287e9bc232

        SHA256

        39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

        SHA512

        d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\_ssl.pyd
        Filesize

        155KB

        MD5

        069bccc9f31f57616e88c92650589bdd

        SHA1

        050fc5ccd92af4fbb3047be40202d062f9958e57

        SHA256

        cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32

        SHA512

        0e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\base_library.zip
        Filesize

        1.4MB

        MD5

        d0ad2b400f15d1bbaf48c8908bee5b0f

        SHA1

        c3f25ea44c69180bc7dff7f2615a4010badc9b4e

        SHA256

        b178b21bd1653a95b626840f565806b8e121962db6b3ae332632d5948323263e

        SHA512

        516183b61b5b65031b07876f4f35f6436cc6cd5b0c395ba18f96d42082e700b88d95bf48e029300674001bba9a8a9820e7e96134f3c55b9d457aba479dff955c

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libcrypto-1_1.dll
        Filesize

        3.3MB

        MD5

        6f4b8eb45a965372156086201207c81f

        SHA1

        8278f9539463f0a45009287f0516098cb7a15406

        SHA256

        976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

        SHA512

        2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libffi-8.dll
        Filesize

        34KB

        MD5

        32d36d2b0719db2b739af803c5e1c2f5

        SHA1

        023c4f1159a2a05420f68daf939b9ac2b04ab082

        SHA256

        128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

        SHA512

        a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\libssl-1_1.dll
        Filesize

        686KB

        MD5

        8769adafca3a6fc6ef26f01fd31afa84

        SHA1

        38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

        SHA256

        2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

        SHA512

        fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\python311.dll
        Filesize

        5.5MB

        MD5

        9a24c8c35e4ac4b1597124c1dcbebe0f

        SHA1

        f59782a4923a30118b97e01a7f8db69b92d8382a

        SHA256

        a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

        SHA512

        9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\select.pyd
        Filesize

        28KB

        MD5

        97ee623f1217a7b4b7de5769b7b665d6

        SHA1

        95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

        SHA256

        0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

        SHA512

        20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

      • C:\Users\Admin\AppData\Local\Temp\_MEI27922\unicodedata.pyd
        Filesize

        1.1MB

        MD5

        bc58eb17a9c2e48e97a12174818d969d

        SHA1

        11949ebc05d24ab39d86193b6b6fcff3e4733cfd

        SHA256

        ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa

        SHA512

        4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c