Overview
overview
4Static
static
4freshwomen...hWomen
ubuntu-18.04-amd64
4freshwomen...hon.so
ubuntu-20.04-amd64
1freshwomen...api.so
ubuntu-18.04-amd64
1freshwomen...python
ubuntu-18.04-amd64
3freshwomen...ythonw
ubuntu-18.04-amd64
3freshwomen.../zsync
ubuntu-18.04-amd64
1freshwomen...ncmake
ubuntu-18.04-amd64
1freshwomen...47.dll
windows10-2004-x64
1freshwomen...GL.dll
windows7-x64
1freshwomen...GL.dll
windows10-2004-x64
1freshwomen...v2.dll
windows7-x64
1freshwomen...v2.dll
windows10-2004-x64
1freshwomen....7.dll
windows7-x64
1freshwomen....7.dll
windows10-2004-x64
1freshwomen...on.dll
windows7-x64
1freshwomen...on.dll
windows10-2004-x64
1freshwomen...rs.dll
windows7-x64
1freshwomen...rs.dll
windows10-2004-x64
1freshwomen...on.exe
windows7-x64
1freshwomen...on.exe
windows10-2004-x64
1freshwomen...nw.exe
windows7-x64
1freshwomen...nw.exe
windows10-2004-x64
1freshwomen...ay.vbs
windows7-x64
1freshwomen...ay.vbs
windows10-2004-x64
1freshwomen...64.dll
windows7-x64
1freshwomen...64.dll
windows10-2004-x64
1freshwomen...nc.exe
windows7-x64
1freshwomen...nc.exe
windows10-2004-x64
1freshwomen...ke.exe
windows7-x64
1freshwomen...ke.exe
windows10-2004-x64
1freshwomen...er.pyo
windows7-x64
3freshwomen...er.pyo
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 23:11
Behavioral task
behavioral1
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/FreshWomen
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/librenpython.so
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral3
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/libsteam_api.so
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral4
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/python
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral5
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/pythonw
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/zsync
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral7
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/zsyncmake
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral8
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libEGL.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libGLESv2.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libpython2.7.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libpython2.7.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/librenpython.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/librenpython.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/nvdrs.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/nvdrs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/python.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/python.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/pythonw.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/pythonw.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/say.vbs
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/say.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/steam_api64.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/steam_api64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsync.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsync.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsyncmake.exe
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsyncmake.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/python2.7/BaseHTTPServer.pyo
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/python2.7/BaseHTTPServer.pyo
Resource
win10v2004-20240508-en
General
-
Target
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/librenpython.dll
-
Size
14.0MB
-
MD5
ad8b90e1dd66e53a30198740f1463b51
-
SHA1
1d3a85df330cf67504f762c2757787efc5924a37
-
SHA256
819587a4f9c76265dd075bdeceda6c240ed7c6662613539381f6ac703bb72c02
-
SHA512
826a8e15f9021136ad86d87a85f709c94ab543cd364f62510e075fd93b1af62cf8a9b7c6284440586bd411a7da303a476106b82956e313351b6eb731b8b2b9ea
-
SSDEEP
98304:n1AQRT5ZTsKT/GbY+4LnyxHyUAITrnQ5O9uJrLCGqsmbxyKxPhbGYtIjVHxyl49Y:n97PkYMDXGyt46vGXa/79mydhRD2AgEV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1808 wrote to memory of 2064 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 2064 1808 rundll32.exe WerFault.exe PID 1808 wrote to memory of 2064 1808 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\freshwomen-season-2-episode-2-part-3-pc-720p-compressed\lib\py2-windows-x86_64\librenpython.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1808 -s 2162⤵PID:2064
-