d9cd6884ad7518018efaa52cde9c0ed46fba959e9ea093c97e68004dbf2cad66

Resubmissions

18-05-2024 22:03

240518-1ylw4aaa81 7

17-05-2024 15:56

240517-tdfq1sfb58 9

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winAPI.exe
Size

28.5MB
MD5

a6c1b27e646cf5904a69e45ffc8808d5
SHA1

7cbafd874594bf3ee91cc49d7fa8ec686b4cad80
SHA256

d9cd6884ad7518018efaa52cde9c0ed46fba959e9ea093c97e68004dbf2cad66
SHA512

b55adebe3be59f15eb66a80d2b328d20e3a7fb1aa8d666e37195855f0a510e9abaefe0ad58ec20e14b1d3426995c9e54c6fe9491704db44931a2777eb5e8c2c8
SSDEEP

393216:Em+sFHI7EzNFAUYl8XRQo/gCcT5NB35jmxEsYAwD6UWsNWcxjQl:Em+GCl3nNWclM

Score

7^/10

pyinstaller upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2692	vjdpeg.exe
2760	vjdpeg.exe
1208	Process not Found
2040	efgblx.exe
2168	efgblx.exe

Loads dropped DLL 8 IoCs

pid	Process
2624	cmd.exe
2692	vjdpeg.exe
2760	vjdpeg.exe
380	cmd.exe
2040	efgblx.exe
2168	efgblx.exe
1208	Process not Found
1208	Process not Found

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001959c-247.dat	upx
behavioral1/memory/2168-249-0x000007FEF5B80000-0x000007FEF6169000-memory.dmp	upx

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000b000000014e3d-1.dat	pyinstaller
behavioral1/files/0x00130000000155d9-195.dat	pyinstaller

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2624	1432	winAPI.exe	28
PID 1432 wrote to memory of 2624	1432	winAPI.exe	28
PID 1432 wrote to memory of 2624	1432	winAPI.exe	28
PID 2624 wrote to memory of 2692	2624	cmd.exe	30
PID 2624 wrote to memory of 2692	2624	cmd.exe	30
PID 2624 wrote to memory of 2692	2624	cmd.exe	30
PID 2692 wrote to memory of 2760	2692	vjdpeg.exe	31
PID 2692 wrote to memory of 2760	2692	vjdpeg.exe	31
PID 2692 wrote to memory of 2760	2692	vjdpeg.exe	31
PID 1432 wrote to memory of 380	1432	winAPI.exe	34
PID 1432 wrote to memory of 380	1432	winAPI.exe	34
PID 1432 wrote to memory of 380	1432	winAPI.exe	34
PID 380 wrote to memory of 2040	380	cmd.exe	36
PID 380 wrote to memory of 2040	380	cmd.exe	36
PID 380 wrote to memory of 2040	380	cmd.exe	36
PID 2040 wrote to memory of 2168	2040	efgblx.exe	37
PID 2040 wrote to memory of 2168	2040	efgblx.exe	37
PID 2040 wrote to memory of 2168	2040	efgblx.exe	37

C:\Users\Admin\AppData\Local\Temp\winAPI.exe
"C:\Users\Admin\AppData\Local\Temp\winAPI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start C:\Users\Admin\AppData\Local\Temp\vjdpeg.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\vjdpeg.exe
    C:\Users\Admin\AppData\Local\Temp\vjdpeg.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\vjdpeg.exe
      C:\Users\Admin\AppData\Local\Temp\vjdpeg.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start C:\Users\Admin\AppData\Local\Temp\efgblx.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\efgblx.exe
    C:\Users\Admin\AppData\Local\Temp\efgblx.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\efgblx.exe
      C:\Users\Admin\AppData\Local\Temp\efgblx.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20402\python311.dll

Filesize
1.6MB

MD5
affa456007f359e9f8c5d2931d966cb9

SHA1
9b06d6cb7d7f1a7c2fa9e7f62d339b9f2813e80f

SHA256
4bab2e402a02c8b2b0542246d9ef54027a739121b4b0760f08cd2e7c643ed866

SHA512
7c357f43dd272e1d595ccde87c13fd2cdf4123b20af6855576bfba15afd814a95886cebbe96bb7781b916f9db3c3ee02d381036ddbf62095de3ee43a7f94d156

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26922\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit
\Users\Admin\AppData\Local\Temp\efgblx.exe

Filesize
11.3MB

MD5
69d768d3f235bfcd24aa3c852e7e46f5

SHA1
c605223f70221611d2b6bdd725f2f42141c71e70

SHA256
ac88513218970a47e4857326bbc37febd07d738aabe37671fbaa6f66907bf368

SHA512
884960b7618dedb0510ca2083155456f46f80d3124a86c8e0b23d8e0b8b4804d6a99e553a01a486d03f5970b8334979f1fae99e5d0c394e0370f2caee4e5ab12

Download Submit
\Users\Admin\AppData\Local\Temp\vjdpeg.exe

Filesize
16.1MB

MD5
bd0d8e59c1911f5ed94379c4869859a5

SHA1
ba1a430e3926b83b1fbc644be29441314dfa920d

SHA256
bc5076e518185162d8b3e0aff412bc60a5ed4bc35b429f80b8de7f0124cb57b7

SHA512
712fca925bf13013cd6d4c3026f869010d4f90b3088d0846408632ea1513614e4c2746c99aac7e4df2e5aea8d2e6d399370fe4b2156f3a266526d2390daac825

Download Submit
memory/2168-249-0x000007FEF5B80000-0x000007FEF6169000-memory.dmp

Filesize
5.9MB

Download