Analysis

  • max time kernel
    89s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/05/2024, 18:45

General

  • Target

    1.exe

  • Size

    16.1MB

  • MD5

    5a6fb976038ecc06c03a325d6cc2f229

  • SHA1

    7fc052589af7cde03edd0cc4285c70740a6b0110

  • SHA256

    a763ed959f9acbf036762256ba095c9a55de175cbc0844da572e6e01810bab32

  • SHA512

    9e144eb83001818b31300c9c9deacf14edae989800b35af6bc937d622e2bbf20d17f80bc747ee05a5a2f43d1d8f0ec8244660c072adb0fd4969b7dbbc7351b8f

  • SSDEEP

    393216:Id07D6k3meWcGfd9YMBaw2pGW8O8nEnO:Idm6ag5F9YC2IW8Ob

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 45 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:1944
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4628
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\yandex_pass.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:3040

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Cipher\_raw_cbc.pyd

              Filesize

              12KB

              MD5

              ff2c1c4a7ae46c12eb3963f508dad30f

              SHA1

              4d759c143f78a4fe1576238587230acdf68d9c8c

              SHA256

              73cf4155df136db24c2240e8db0c76bedcbb721e910558512d6008adaf7eed50

              SHA512

              453ef9eed028ae172d4b76b25279ad56f59291be19eb918de40db703ec31cddf60dce2e40003dfd1ea20ec37e03df9ef049f0a004486cc23db8c5a6b6a860e7b

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Cipher\_raw_cfb.pyd

              Filesize

              13KB

              MD5

              fe489576d8950611c13e6cd1d682bc3d

              SHA1

              2411d99230ef47d9e2e10e97bdea9c08a74f19af

              SHA256

              bb79a502eca26d3418b49a47050fb4015fdb24bee97ce56cdd070d0fceb96ccd

              SHA512

              0f605a1331624d3e99cfdc04b60948308e834aa784c5b7169986eefbce4791faa148325c1f1a09624c1a1340e0e8cf82647780ffe7b3e201fdc2b60bcfd05e09

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Cipher\_raw_ctr.pyd

              Filesize

              14KB

              MD5

              a33ac93007ab673cb2780074d30f03bd

              SHA1

              b79fcf833634e6802a92359d38fbdcf6d49d42b0

              SHA256

              4452cf380a07919b87f39bc60768bcc4187b6910b24869dbd066f2149e04de47

              SHA512

              5d8bdca2432cdc5a76a3115af938cc76cf1f376b070a7fd1bcbf58a7848d4f56604c5c14036012027c33cc45f71d5430b5abbfbb2d4adaf5c115ddbd1603ab86

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Cipher\_raw_ecb.pyd

              Filesize

              10KB

              MD5

              821aaa9a74b4ccb1f75bd38b13b76566

              SHA1

              907c8ee16f3a0c6e44df120460a7c675eb36f1dd

              SHA256

              614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54

              SHA512

              9d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Cipher\_raw_ofb.pyd

              Filesize

              12KB

              MD5

              619fb21dbeaf66bf7d1b61f6eb94b8c5

              SHA1

              7dd87080b4ed0cba070bb039d1bdeb0a07769047

              SHA256

              a2afe994f8f2e847951e40485299e88718235fbefb17fccca7ace54cc6444c46

              SHA512

              ee3dbd00d6529fcfcd623227973ea248ac93f9095430b9dc4e3257b6dc002b614d7ce4f3daab3e02ef675502afdbe28862c14e30632e3c715c434440615c4dd4

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Hash\_BLAKE2s.pyd

              Filesize

              14KB

              MD5

              cea18eb87e54403af3f92f8d6dbdd6e8

              SHA1

              f1901a397edd9c4901801e8533c5350c7a3a8513

              SHA256

              7fe364add28266c8211457896d2517fdb0ee9efc8cb65e716847965b3e9d789f

              SHA512

              74a3c94d8c4070b66258a5b847d9ced705f81673dd12316604e392c9d21ae6890e3720ca810b38e140650397c6ff05fd2fa0ff2d136fc5579570520ffdc1dbac

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Hash\_SHA1.pyd

              Filesize

              17KB

              MD5

              5e6fef0ff0c688db13ed2777849e8e87

              SHA1

              3e739107b1b5ff8f1ffaac2ede75b71d4ebd128f

              SHA256

              e88a0347f9969991756815dff0af940f00e966bc7875aa4763a2c80516f7e4ed

              SHA512

              b97d4aa0ae76f528e643180ed300f1a50eafe8b82c27212a95ce380bca85f9ce1ff1ac1190173d56776fd663f649817514d6501ce80518f526159398daa6f55c

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Hash\_SHA256.pyd

              Filesize

              21KB

              MD5

              6abdcd64face45efb50a3f2d6d792b93

              SHA1

              038dbd53932c4a539c69db54707b56e4779f0eef

              SHA256

              1031ea4c1fd2f673089052986629b6f554e5b34582b2f38e134fd64876d9ce0f

              SHA512

              6ebe3572938734d0fa9e4ec5abdb7f63d17f28ba7e94f1fe40926be93668d1a542ffc963f9a49c5f020720caad0852579fed6c9c6d0ab71b682e27245adc916c

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\Crypto\Util\_strxor.pyd

              Filesize

              10KB

              MD5

              3af448b8a7ef86d459d86f88a983eaec

              SHA1

              d852be273fea71d955ea6b6ed7e73fc192fb5491

              SHA256

              bf3a209eda07338762b8b58c74965e75f1f0c03d3f389b0103cc2bf13acfe69a

              SHA512

              be8c0a9b1f14d73e1adf50368293eff04ad34bda71dbf0b776ffd45b6ba58a2fa66089bb23728a5077ab630e68bf4d08af2712c1d3fb7d79733eb06f2d0f6dbf

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\PIL\_imaging.cp311-win_amd64.pyd

              Filesize

              2.5MB

              MD5

              40161f97be89efba847554e36b226698

              SHA1

              65c8499a802f21a3b716ffdabd5b0e40548f5195

              SHA256

              69bee07eb107f9daad969a16e1497f210b5d30a1a8ddd5c7bd8a5467bbcdee85

              SHA512

              7bd182e249fac4ff0fa84b5750144b6434cc2027a6d78a801decdd292de7143eb3175490d116e9b344f4ababcdbae824fe833bff7a768bf9033c01efa7c72856

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\VCRUNTIME140.dll

              Filesize

              106KB

              MD5

              49c96cecda5c6c660a107d378fdfc3d4

              SHA1

              00149b7a66723e3f0310f139489fe172f818ca8e

              SHA256

              69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

              SHA512

              e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\VCRUNTIME140_1.dll

              Filesize

              48KB

              MD5

              cf0a1c4776ffe23ada5e570fc36e39fe

              SHA1

              2050fadecc11550ad9bde0b542bcf87e19d37f1a

              SHA256

              6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

              SHA512

              d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_bz2.pyd

              Filesize

              82KB

              MD5

              4438affaaa0ca1df5b9b1cdaa0115ec1

              SHA1

              4eda79eaf3de614d5f744aa9eea5bfcf66e2d386

              SHA256

              ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85

              SHA512

              6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_ctypes.pyd

              Filesize

              120KB

              MD5

              6114277c6fc040f68d25ca90e25924cd

              SHA1

              028179c77cb3ba29cd8494049421eaa4900ccd0e

              SHA256

              f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656

              SHA512

              76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_hashlib.pyd

              Filesize

              63KB

              MD5

              1524882af71247adecf5815a4e55366a

              SHA1

              e25014c793c53503bdff9af046140edda329d01b

              SHA256

              6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327

              SHA512

              5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_lzma.pyd

              Filesize

              155KB

              MD5

              737119a80303ef4eccaa998d500e7640

              SHA1

              328c67c6c4d297ac13da725bf24467d8b5e982e3

              SHA256

              7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28

              SHA512

              1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_queue.pyd

              Filesize

              31KB

              MD5

              8bbed19359892f8c95c802c6ad7598e9

              SHA1

              773fca164965241f63170e7a1f3a8fa17f73ea18

              SHA256

              4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065

              SHA512

              22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_socket.pyd

              Filesize

              77KB

              MD5

              64a6c475f59e5c57b3f4dd935f429f09

              SHA1

              ca2e0719dc32f22163ae0e7b53b2caadb0b9d023

              SHA256

              d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49

              SHA512

              cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_sqlite3.pyd

              Filesize

              117KB

              MD5

              a7df575bf69570944b004dfe150e8caf

              SHA1

              2fd19be98a07347d59afd78c167601479aac94bb

              SHA256

              b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b

              SHA512

              18c381a4ded8d33271cbf0bea75af1c86c6d34cc436f68fb9342951c071c10d84cf9f96a0509c53e5886d47fed5bca113a7f7863f6873583daa7bb6af1aa9afa

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\_ssl.pyd

              Filesize

              172KB

              MD5

              a0b40f1f8fc6656c5637eacacf7021f6

              SHA1

              38813e25ffde1eee0b8154fa34af635186a243c1

              SHA256

              79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1

              SHA512

              c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\base_library.zip

              Filesize

              1.8MB

              MD5

              1df66a5a8d8c7bc333ed59a827e131e3

              SHA1

              614986f57b9922cedf4df5ebadaa10ea307d46d1

              SHA256

              190afb1aa885c2aa3516ab343e35f6b10472f4314492c8c4492c7d0f2add2f80

              SHA512

              6568af0d41b1d2f1d4a75e25705777ec263c4a903db164923f4a10118218270a2b003f16f39ae238fe71f0dc1ad52d0cc1ac93a7bf2c6643d009f825dd00e1aa

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\charset_normalizer\md.cp311-win_amd64.pyd

              Filesize

              10KB

              MD5

              28af0ffb49cc20fe5af9fe8efa49d6f1

              SHA1

              2c17057c33382ddffea3ca589018cba04c4e49d7

              SHA256

              f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0

              SHA512

              9aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

              Filesize

              110KB

              MD5

              6cdca2fde9df198da58955397033af98

              SHA1

              e457c97721504d25f43b549d57e4538a62623168

              SHA256

              a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7

              SHA512

              7b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\libcrypto-3.dll

              Filesize

              4.9MB

              MD5

              7a6a8c2a8c379b111cdceb66b18d687d

              SHA1

              f3b8a4c731fa0145f224112f91f046fddf642794

              SHA256

              8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b

              SHA512

              f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\libffi-8.dll

              Filesize

              38KB

              MD5

              0f8e4992ca92baaf54cc0b43aaccce21

              SHA1

              c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

              SHA256

              eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

              SHA512

              6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\libssl-3.dll

              Filesize

              771KB

              MD5

              64acb046fe68d64ee475e19f67253a3c

              SHA1

              d9e66c9437ce6f775189d6fdbd171635193ec4cc

              SHA256

              b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10

              SHA512

              f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\python311.dll

              Filesize

              5.5MB

              MD5

              58e01abc9c9b5c885635180ed104fe95

              SHA1

              1c2f7216b125539d63bd111a7aba615c69deb8ba

              SHA256

              de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

              SHA512

              cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\pywin32_system32\pywintypes311.dll

              Filesize

              131KB

              MD5

              90b786dc6795d8ad0870e290349b5b52

              SHA1

              592c54e67cf5d2d884339e7a8d7a21e003e6482f

              SHA256

              89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

              SHA512

              c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\select.pyd

              Filesize

              29KB

              MD5

              653bdccb7af2aa9ccf50cb050fd3be64

              SHA1

              afe0a85425ae911694c250ab4cb1f6c3d3f2cc69

              SHA256

              e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279

              SHA512

              07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\sqlite3.dll

              Filesize

              1.4MB

              MD5

              b49b8fde59ee4e8178c4d02404d06ee7

              SHA1

              1816fc83155d01351e191d583c68e722928cce40

              SHA256

              1afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f

              SHA512

              a033ce87c2e503b386fb92aa79a7ec14d6c96e4a35d0cb76d4989bacd16f44c4ed5ac4e13057f05f9d199a3fd8545b9a25296515ec456f29c464d949ff34942a

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\unicodedata.pyd

              Filesize

              1.1MB

              MD5

              1905b5d0f945499441e8cd58eb123d86

              SHA1

              117e584e6fcc0e8cfc8e24e3af527999f14bac30

              SHA256

              b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532

              SHA512

              ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522

            • C:\Users\Admin\AppData\Local\Temp\_MEI39282\win32\win32crypt.pyd

              Filesize

              121KB

              MD5

              5390ade0ed5428024f3d854b5b9bfe9f

              SHA1

              dada7b44887dcb7b77dcadb9690baecf3ee2b937

              SHA256

              9771f09be29bd7a69abe774e28472a392382883c18a3cc524f8141e84b1be22c

              SHA512

              92e82eff79f45d4de1cf27946a357f122c5337a85315d7c139458a1a6a51dffbf3cbfcf832851fbdcd0ec1bd0f82e7089125ffbbe3275675433089bddbff865b