Resubmissions

25/04/2024, 01:21

240425-bqxwyscg54 7

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/04/2024, 01:21

General

  • Target

    LaZagne.exe

  • Size

    11.3MB

  • MD5

    282df7bcb720a5b6f409caf9ccda2f75

  • SHA1

    0e62d10ff194e84ed8c6bd71620f56ef9e557072

  • SHA256

    3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05

  • SHA512

    74bbcefb87c037ec93312f67b739c2486258d83e0fb7628352a1dd482c0277a82073427856c0848cda451b7322faab0ae2e6878501c2867827ce6bd9798f3229

  • SSDEEP

    196608:0cHu78K//UoEkXuWJysVYvsOfhumHhtdIQLOMIdiwXa6vTVzy/BOfN1XZuoJnB:Bu7L//HEnWJIuahtaL/dg67RywfNxZuu

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LaZagne.exe
    "C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\LaZagne.exe
      "C:\Users\Admin\AppData\Local\Temp\LaZagne.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\_socket.pyd

    Filesize

    74KB

    MD5

    10cd16bb63862536570c717ffc453da4

    SHA1

    b3ef50d7ac4652b5c35f1d86a0130fb43dd5a669

    SHA256

    e002a1bd6fba44681d557b64d439585dba9820226e1c3da5a62628bbaa930ae3

    SHA512

    55ee581c4005901661efaf9aad6ea39b2b2e265579539d464d62e4209638567b3b9fdd945d0bed0a1047f977d374a5707a970c621ca289077e2d6c5aeca491b1

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    6a6f368802fefdd7c62cfa942e07ae51

    SHA1

    1012e2163d64b374fc784cb15205010492879d5d

    SHA256

    b7e6f1144d596ee1784359f384a3498bab32804add8c24bcf65964b413fb508d

    SHA512

    0dd5fb0bd23c8215254447d6e77d5bf95df8bf1c2e9f6f27dea1040ca496bd4135b40efe7f3bd4f8ab8300456a582b1596aeaea495dccab8fd4c7acf3c0034d0

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    21KB

    MD5

    ac718755753807cef7c5026dd8a58027

    SHA1

    4b39d0a3d442fbebcc7ac5fe35d3752dad87f58b

    SHA256

    b0418241a1c8c2ac1a230d586b0200f9e1033d1833dfd5f48719a1b611ae3fbc

    SHA512

    ef9b9f04ec1da1c63e1d1e8bdcf3d929dab9725383f58c94554aea801ef39f47c1a97115a57b4ae7390db59a979478940ea9e2b41003796745c0bfb159955a1e

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    efc8f224ea2f4af24b13329971cf551f

    SHA1

    a16fdedefe4bc6201243301624329525199e4f8d

    SHA256

    fea7c286fb3140a8d8739f2961a524c00dd0ad086f1d4517b74a84d7bb7dc18b

    SHA512

    5405abb3a52489b0c6a94cc1b840dfae2bded14e53f39bdcd4b8d8f0d8bfa9b43138d5a6eba1a1804d6fc2efe4dd21df1e223d4c77dd07bcafdedd7a4031512e

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\base_library.zip

    Filesize

    762KB

    MD5

    4dbdcd4c1d91ebb19d0520ad80f35d78

    SHA1

    1a2e0de2cb1c5be36d3e7ad691bf6b27436dbdb7

    SHA256

    c74288cc76f67f9f3be2ce61b3c4b1df78b082f4d55dc4dd7b68f6a4803ea47e

    SHA512

    8a298985628c895a67adf9538e92ff7527219163dc1c491f5c250bd36532d66f9d9530c04778d535535eeb0f22dcb4c55d22ab3459b6e827d614ca1e7c647031

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\lazagne.exe.manifest

    Filesize

    1KB

    MD5

    6fe7232e13f5f8307c037b54fe0dcc10

    SHA1

    510075454d9179d1c6669df67f126213aabcb99f

    SHA256

    4996109560a79774034a05b398d64b1b441c49f0f03682c4683554c59dd47e5c

    SHA512

    8893febd884f6411025ff9df7d0ef2dbc756baa93903423e805b5e981273838567f2ea60d072d4d98fe9b2f2c25a85800522cebc5e832a3256d4c10605085725

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\libcrypto-1_1.dll

    Filesize

    1.2MB

    MD5

    b4c6e2b5c1919c6868c42add3a54355b

    SHA1

    6363849bd436925c361cf1fb9f571c1a23a1fe79

    SHA256

    d9d86d637f6c615e76a6d408af92d0fb1e771b517a47cada08fe4b287c588ab9

    SHA512

    1d4fbc38d85a70401f56920645ca45bc0b48da119555f02e05926b9a5f11b04fcc2913b7d2054cf1489f589e54d2c42383700fcf5e3543822a00d84c0dabccdd

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\python37.dll

    Filesize

    2.8MB

    MD5

    5fe9ce650191d39187dd05beb5013e90

    SHA1

    673ebcd5c4571f9d84486109ab283e4e2a9886c2

    SHA256

    824319c4a3db0ed7a67eaab0afcd61692c914a84924128f0fcf5466b85449d0d

    SHA512

    3b69d13d0254e3bda34173d32995da580a0d27babc6c2dd20ed4a8f56a8c2b72d1ceb705c4edae27ef9cae478d3cb5745231b0af650e17180d36b5742906d833

  • C:\Users\Admin\AppData\Local\Temp\_MEI17202\ucrtbase.dll

    Filesize

    970KB

    MD5

    aad2e99881765464c9ad9ccdbe78f0e0

    SHA1

    8634ce21a2683674210e836822fda448262e2e16

    SHA256

    e6287f7ba5892c99da70e9785d320a665809ca8e657a64b9fef1e8afcfb6a2f9

    SHA512

    68d2e898cdd73a3ad41ef3db7a149588a82629ac0628c07606f009bd6a92a62f9816c995b1794c8a957a4f3c55a72fcab17a400a2f55016a0ee8d773a172d002

  • \Users\Admin\AppData\Local\Temp\_MEI17202\VCRUNTIME140.dll

    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_bz2.pyd

    Filesize

    87KB

    MD5

    92075c2759ac8246953e6fa6323e43fe

    SHA1

    6818befe630c2656183ea7fe735db159804b7773

    SHA256

    e7af6119b56ddd47fd0a909710f7163d7ef4822405fc138d24e6ce9de7a5022f

    SHA512

    7f3a4409859695f53291c96dd487bca2649815bad5f4610c2c6f92777411d39210e293d962573a20dfe73ea15331de7e6c18b017ae1d6f226387eab1fc1f586c

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_ctypes.pyd

    Filesize

    131KB

    MD5

    2787764fe3056f37c79a3fc79e620172

    SHA1

    a64d1a047ba644d0588dc4288b74925ed72e6ed4

    SHA256

    41c593c960f3f89b1e1629c6b7bd6171fe306168f816bef02027332a263de117

    SHA512

    1dc5bb470be558c643a3f68e23423697384bc547b1192cd398dff640e28f7df85563bc87643cdcde9b8b4f880f272e13a673a018ae251e100bd99790f993afa0

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_hashlib.pyd

    Filesize

    38KB

    MD5

    7808b500fbfb17c968f10ee6d68461df

    SHA1

    2a8e54037e7d03d20244fefd8247cf218e1d668f

    SHA256

    e2701f4e4a7556adab7415e448070289ba4fe047227f48c3a049d7c3154aff0b

    SHA512

    b4239e792141bcf924f61bfd46033934337079b245f423b34820d36c6599ca35ab06bc525acfff4cafa75e31975fcd0409dedd203377d642fc5dc55ec2c1fa27

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_lzma.pyd

    Filesize

    251KB

    MD5

    ab582419629183e1615b76fc5d2c7704

    SHA1

    b78ee7e725a417bef50cca47590950e970eae200

    SHA256

    5a45f7cd517ad396a042bc2767ae73221dc68f934e828a9433249924a371ee5e

    SHA512

    3f38441dd0b88b486dafaa1e15d07f0ee467a362c1603071a2fa79de770fa061ced25ca790f0d3139f31178c719cc82ac88601262e2a0ca809708dfa3f6f76ca

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_queue.pyd

    Filesize

    27KB

    MD5

    a48af48dd880c11673469c1ade525558

    SHA1

    01e9bbcd7eccaa6d5033544e875c7c20f8812124

    SHA256

    a98e9f330eeaf40ef516237ab5bc1efac1fc49ed321a128be78dd3fb8733e0a4

    SHA512

    a535dadb79c1ca10506858226442d1d1fb00e5d6f99afa6b539e2506a6627a7bd624a7ee2bc61f55c974113de80fd7a95e6c18e9402736d32d5099077ca1b913

  • \Users\Admin\AppData\Local\Temp\_MEI17202\_sqlite3.pyd

    Filesize

    84KB

    MD5

    244d92824ef54b139ecd4f2b58a5d9d5

    SHA1

    ff5696f6e3dc42e578a580299ac53d8c5e11d917

    SHA256

    fd55c3e3b2863425050619b8d42fe19cf06c1c8e2e11f7076e1f4422663e6851

    SHA512

    10fba938064bca2b9163d6c0d0a0361d0ebd896e32346cade3e4a439475c223ced59ac8f9c51727d5556149b14990ab62ee6769c35cf067aaac5d63dd5d4688f

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-core-file-l1-2-0.dll

    Filesize

    18KB

    MD5

    f58b1e1f6168d526473289f5f15cc66f

    SHA1

    ef9d3d6307dcbfc3b357b2dd30a75b08998c09b5

    SHA256

    ee778641ebc47383926d62d56612f25487151a183d76e3a2d013f658f6917918

    SHA512

    1278a6be2baaf05696c22db325faf2c90bc319fcb57daa6fcd2f2d95c1074797247d4a5df4d7e46f7177f1da07e9133f45c61c28e16a71b8d82ff627671b52f9

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    19KB

    MD5

    833aa996973b87eff6cdfea246d22999

    SHA1

    b89dc8d3f4aa772e32de79bb485c48054aa64361

    SHA256

    8831b1419c675ac71305ed616fa6aad97b068cc55796d1afc7593a1df2491226

    SHA512

    dfd12536e519f45294daa070aa35a8b1d32660e718e894f5e782d8bc093911b32f01052a1a9a79746e604b861d3794a4fef3b5bcad900c63460f243ff31fd416

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    19KB

    MD5

    5e7d46dd3aa282ea86a4e35f4753461b

    SHA1

    5a7d5ddb39b8c75f4cf6a8724dc2c6b33393ed1f

    SHA256

    07cc434e4af6d72a0e2e4313ca2be77dfe0b3a7de9d71e08131f840e0a6028d1

    SHA512

    9522b5aa48fe5098d72ec85dec7aaf02ff8394caf967a5b67d9c88033a248a22715b159ff3ccf58e1b9e6d3470c403c6c45ba17527ee9f4f1c302e161c0cfac1

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    22KB

    MD5

    20ae5bab58dbf000696a24d009c24cf9

    SHA1

    a601c57c4b357a183a962007448ae6a47c066c98

    SHA256

    aaaea589cd89555c7e5eb464d1f98a1e47443767d2d7571bb11e924afde9b1a9

    SHA512

    d9e5443d7e7a63fe1d380e38add178fdbc080f67614f13882c8b0f933b01c5f35f213859dcc772e6068f5b24345c707834f4aba374deea0de339206f65404134

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    19KB

    MD5

    08bae65704d7f953c89be68fe2f27f85

    SHA1

    e09579903b7fb9ed8fddd4ea7af800c71d4278e5

    SHA256

    8fd3e70e50f9087d73c29fffd0e16bc644c9e0e5802f2a5f07b6d3b5c0b4b0dd

    SHA512

    34bd09c7a22e34ce75ad3f4ff7cf93143600c9bbee24207d9711f731f68f49804ad2ac4843d58f224d22100da3ee779c86c6df1a87179cd74b8df74b7fea4e65

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    20KB

    MD5

    baac525aac4f2735d60692a6b9e3ba52

    SHA1

    ef9188a8daf0d7d1740aad8c225845ca2fb82c66

    SHA256

    92baddffec31289e7dafc15ab56a49d93ceb266e0f0d120a5ef0fb1bce20dca1

    SHA512

    0fda206266e44181f83b4ab49ac9b0a3e75a3fc8e86dedc74e3ed7517a6af950e7f196bcb2cd50ae220cc5ce4c2d58ad4047f8aa9da57ff3645a97aa653618f4

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    19KB

    MD5

    5bff09fe93358508fe966cf8ca0f81c5

    SHA1

    da0e180079ed9a23a03b6181f44a6db40f7bba22

    SHA256

    1ff08dae5644a72047772e616537f4bd80414134944eb49168447e14b83ea9b4

    SHA512

    cd01bf9db64cedc6ee1abce8e4cc880aa3473961d3c4d5a93b61b514ff9665ed8929b8f2cb4000994bafcd07ae708fec6ae99115e5940b4f95acc0bc865c6cdb

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    19KB

    MD5

    8636ad6ba8c5c9efcd5afea665ead4ca

    SHA1

    858865f45405a99f50838806de75cc1cf06cce64

    SHA256

    7788524de88adae43062d96d50a912ddb5ca2afbb527a628a87f842a98bc5e0b

    SHA512

    bd9d55ddcecd1631c29f1ced8a1e7a82ff4435253095ee6bbfaacca60f6321fc3cd5f67d632e35a35dcc8b604cb7a13b378a0bfed340bb7f77ac207ed10cbbe3

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    27KB

    MD5

    08fea493e6cb3cdd267b9fc9fd0c6fd7

    SHA1

    447427cb9edb6ca4bdfc6a63a95b326a0ab6d55d

    SHA256

    93b7d156846ef90e76fdfc05987c28b437644f0592acd82b179fc72b8cf9c395

    SHA512

    ad78ab3774d79c400229db56202e15ad22e5a14d20e9d5e554f6edbcb01ef18c9c1bcbc6569ed6b698cce1428e15c63a970b8f350c862a580b468a67401793dd

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    19KB

    MD5

    d911e8d952088498848600dcb20efb2c

    SHA1

    e5afdec39480e945c12ef86f77bd719ccf4b1de9

    SHA256

    9ce47ff49fc0dcab1ad8ee594e218d8cce299d5e23473ff1ecb868023bfcc533

    SHA512

    88fd72d76f57af3d925e757532bc29317a7f35b7eb0d00b6534647fee6162e789d9a03ab9fed9e1af357745bc6e765bbc648f5ffac49c11a6d7f2bae2c071a09

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    23KB

    MD5

    3424b3cad00b22c071b2bd376084b8b0

    SHA1

    92cdc77411fa5515d188bd34d921b45e1005b4f8

    SHA256

    9d42ee159384e8b1aa98bfc5b59a4dcdd808cac13d0ee9457dc5c19d3020c55f

    SHA512

    69a71d9dc3a27f2a5253ec98cb32d8961a596606c6f260704a7bcfe77aafa590df9da9ebb88b259926e20efbca18f0bbdac5d18ce97e467540591f8e9a5f4b98

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    24KB

    MD5

    c9dc0be8cb2970e4c49094ccfa16adac

    SHA1

    2a38ce151ce9c93ae0737d29fd358224f535f566

    SHA256

    9e531d7ced9398b85730e9887fe986aabbbe0247f35db2a7a728c0b9278495ff

    SHA512

    efa3b09de2d4ef3783dbb8db37820dd5e203a679666b821cdae356b0571ffc8ff6f364f3e4c37bbafcf0b024b4a2d2976326b646492d5d6d3dcef5a4ecd94a7f

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    24KB

    MD5

    742d61ebf0e70756fb017f80ea8cebcd

    SHA1

    6cc4d970c3ffd313b57c87a67ce1dda2a8b67432

    SHA256

    9a14823aa0cbefb03bf9debee20e0f593af5e78d0fe0a6de679146a680e99f29

    SHA512

    6fc30b6d060fcb3a4dd4852d8e3a2bff405954d17dd8d8b6e0d1ddac7fbe40246836d0785c3ea730eb8dbf17fd3d2dfba68ceef2a798efd846cf23c107335996

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    21KB

    MD5

    21cdb83da91bcedb3ea3463f736ce6dd

    SHA1

    de1b0764b7eaaaea2a88fc1fa564464bcc4bd218

    SHA256

    dcd26dd5137208abdfe22a81c0d97037c62aff59202db4e8328266a4b46ba2eb

    SHA512

    e9a72842284abd51b10df2a9c0ba38cd45704e4bc025c5e8c84c4e8afa98f164e7d051b113b35a8b3a691ad424557ea4074a827c18465ab01bded54abe22eb62

  • \Users\Admin\AppData\Local\Temp\_MEI17202\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    19KB

    MD5

    c681ce55db1faf84ee05e7b2ab3b6ed1

    SHA1

    aedd0a0c47602984ee3123a8e765ce847f5cff15

    SHA256

    b9fb517638bf7fed24177a16015e447527475531463f5a3c2a8e71224ed4d75a

    SHA512

    f45b4deb290bba6edbfd56d898adf164ae17af4284daae98c4d02b202acd9d2fb3eaf2d87544e912aa43c8f7b11fc176043bd243e5059612cf2287a14e97de6a

  • \Users\Admin\AppData\Local\Temp\_MEI17202\libcrypto-1_1.dll

    Filesize

    1.9MB

    MD5

    e8b23d814e7b74a68f52f141abdbcd95

    SHA1

    7bf0de3de89e3b4102a247461e1c679fe57f9ffe

    SHA256

    522e259c0ecb85fe8f2432f594f2868e6fb24b79415edeec52096221c4cf6ec1

    SHA512

    5d0ffd7acd4b56167002bfcc9ed7ce4ba95ef032fbf7306f56c029f8230016f5bb918eecc31bf3659c3c2a857631203d939f9e2d8ca821f8f247121c190715bf

  • \Users\Admin\AppData\Local\Temp\_MEI17202\pyexpat.pyd

    Filesize

    194KB

    MD5

    02d615171b805cc573b28e17611f663f

    SHA1

    2e63b78316b4eae6ee1c25f1f10fbbb84ecef054

    SHA256

    e60b5cbdf7480db1fc829e05ce45703d43d5ba25fdf7fba21cca1d38b1f3b3a4

    SHA512

    b61cd3d16d1a192016a50342ae71fee8f764c4c156e275a320f74cc4ec65755c91c022231d09a76b59d6225960f5a930f1887003b1d6984beeb5a9648b045427

  • \Users\Admin\AppData\Local\Temp\_MEI17202\python37.dll

    Filesize

    1.9MB

    MD5

    382e02600c7062118849b905ddd422ee

    SHA1

    f60543145bcd93d35c2d37a56e06f2a244e27641

    SHA256

    103566fe0cdc6b4d24b38f1f086f1034a9eaaf458b5f5bcd3b3e7285a0ba5e3c

    SHA512

    a6d94cb161659f8aed20d6127197e268f88d96358d29b4d42c14ec32d6d2f7730b2d00c2272149d9f60506fe2eb5fb6403ccc232a8000657a7fbb5d6a96edbcf

  • \Users\Admin\AppData\Local\Temp\_MEI17202\select.pyd

    Filesize

    26KB

    MD5

    39b7c056bca546778690b9922315f9ff

    SHA1

    5f62169c8de1f72db601d30b37d157478723859b

    SHA256

    9514b4c40c35396b1952a8acf805e993a3875b37370f44ef36ed33c7151412ef

    SHA512

    229538131d83299ea90652818c99972c1ee692c070e7fea9599420c99dd8ae75fb2367e9509aad23984fe0a8d21221a59bd57493b5cd1d6c7391c3c55d714e94