njrat | e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b33f2982aa4df81f65b713a7e398b3c.exe
Size 5.2MB
Sample240521-1c14wsbb52
SHA256 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84
MD5 4b33f2982aa4df81f65b713a7e398b3c
SHA1 630b0be15443733a06412b072441ec00075e2f83
SHA512 7efceddfe0d85ea082650d47e3897dd35b3117154fa20b391f2db8626bcb2a3ba04bb0ae3e7efff9fb5585c4c95262f0669c7aa72ff322a8138cb35d8d841205
SSDEEP 98304:Oh9o1ezhQcSZcOb+sX1ZvbeG4Z0FGRABTgtse6vzovknQp:Oh9hhQcERCsXDjfZkJMQp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

127.0.0.1:8848

Mutex

SecurityHealthService.exe

Attributes

reg_key
SecurityHealthService.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	main.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.exe	SecurityHealthService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.exe	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.url	SecurityHealthService.exe

Executes dropped EXE 4 IoCs

pid	Process
2848	main.exe
5016	SecurityHealthService.exe
3016	SecurityHealthService.exe
3672	SecurityHealthService.exe

Loads dropped DLL 4 IoCs

pid	Process
4160	4b33f2982aa4df81f65b713a7e398b3c.exe
4160	4b33f2982aa4df81f65b713a7e398b3c.exe
4160	4b33f2982aa4df81f65b713a7e398b3c.exe
4160	4b33f2982aa4df81f65b713a7e398b3c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService.exe\" .."	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService.exe\" .."	SecurityHealthService.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
20	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3816	schtasks.exe
3532	schtasks.exe
1744	schtasks.exe
988	schtasks.exe
2520	schtasks.exe
3372	schtasks.exe
1104	schtasks.exe
3992	schtasks.exe
2688	schtasks.exe
4868	schtasks.exe
3836	schtasks.exe
4600	schtasks.exe
100	schtasks.exe
4996	schtasks.exe
808	schtasks.exe
748	schtasks.exe
1056	schtasks.exe
4180	schtasks.exe
4552	schtasks.exe
1704	schtasks.exe
4756	schtasks.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe
Token: 33	5016	SecurityHealthService.exe
Token: SeIncBasePriorityPrivilege	5016	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4160	4072	4b33f2982aa4df81f65b713a7e398b3c.exe	85
PID 4072 wrote to memory of 4160	4072	4b33f2982aa4df81f65b713a7e398b3c.exe	85
PID 4160 wrote to memory of 1900	4160	4b33f2982aa4df81f65b713a7e398b3c.exe	87
PID 4160 wrote to memory of 1900	4160	4b33f2982aa4df81f65b713a7e398b3c.exe	87
PID 1900 wrote to memory of 2848	1900	cmd.exe	89
PID 1900 wrote to memory of 2848	1900	cmd.exe	89
PID 1900 wrote to memory of 2848	1900	cmd.exe	89
PID 2848 wrote to memory of 5016	2848	main.exe	98
PID 2848 wrote to memory of 5016	2848	main.exe	98
PID 2848 wrote to memory of 5016	2848	main.exe	98
PID 5016 wrote to memory of 2944	5016	SecurityHealthService.exe	101
PID 5016 wrote to memory of 2944	5016	SecurityHealthService.exe	101
PID 5016 wrote to memory of 2944	5016	SecurityHealthService.exe	101
PID 5016 wrote to memory of 1704	5016	SecurityHealthService.exe	103
PID 5016 wrote to memory of 1704	5016	SecurityHealthService.exe	103
PID 5016 wrote to memory of 1704	5016	SecurityHealthService.exe	103
PID 5016 wrote to memory of 1288	5016	SecurityHealthService.exe	105
PID 5016 wrote to memory of 1288	5016	SecurityHealthService.exe	105
PID 5016 wrote to memory of 1288	5016	SecurityHealthService.exe	105
PID 5016 wrote to memory of 748	5016	SecurityHealthService.exe	107
PID 5016 wrote to memory of 748	5016	SecurityHealthService.exe	107
PID 5016 wrote to memory of 748	5016	SecurityHealthService.exe	107
PID 5016 wrote to memory of 2408	5016	SecurityHealthService.exe	110
PID 5016 wrote to memory of 2408	5016	SecurityHealthService.exe	110
PID 5016 wrote to memory of 2408	5016	SecurityHealthService.exe	110
PID 5016 wrote to memory of 1056	5016	SecurityHealthService.exe	112
PID 5016 wrote to memory of 1056	5016	SecurityHealthService.exe	112
PID 5016 wrote to memory of 1056	5016	SecurityHealthService.exe	112
PID 5016 wrote to memory of 3316	5016	SecurityHealthService.exe	115
PID 5016 wrote to memory of 3316	5016	SecurityHealthService.exe	115
PID 5016 wrote to memory of 3316	5016	SecurityHealthService.exe	115
PID 5016 wrote to memory of 4868	5016	SecurityHealthService.exe	117
PID 5016 wrote to memory of 4868	5016	SecurityHealthService.exe	117
PID 5016 wrote to memory of 4868	5016	SecurityHealthService.exe	117
PID 5016 wrote to memory of 1652	5016	SecurityHealthService.exe	119
PID 5016 wrote to memory of 1652	5016	SecurityHealthService.exe	119
PID 5016 wrote to memory of 1652	5016	SecurityHealthService.exe	119
PID 5016 wrote to memory of 3836	5016	SecurityHealthService.exe	121
PID 5016 wrote to memory of 3836	5016	SecurityHealthService.exe	121
PID 5016 wrote to memory of 3836	5016	SecurityHealthService.exe	121
PID 5016 wrote to memory of 2344	5016	SecurityHealthService.exe	123
PID 5016 wrote to memory of 2344	5016	SecurityHealthService.exe	123
PID 5016 wrote to memory of 2344	5016	SecurityHealthService.exe	123
PID 5016 wrote to memory of 4180	5016	SecurityHealthService.exe	125
PID 5016 wrote to memory of 4180	5016	SecurityHealthService.exe	125
PID 5016 wrote to memory of 4180	5016	SecurityHealthService.exe	125
PID 5016 wrote to memory of 1128	5016	SecurityHealthService.exe	128
PID 5016 wrote to memory of 1128	5016	SecurityHealthService.exe	128
PID 5016 wrote to memory of 1128	5016	SecurityHealthService.exe	128
PID 5016 wrote to memory of 1744	5016	SecurityHealthService.exe	130
PID 5016 wrote to memory of 1744	5016	SecurityHealthService.exe	130
PID 5016 wrote to memory of 1744	5016	SecurityHealthService.exe	130
PID 5016 wrote to memory of 3260	5016	SecurityHealthService.exe	132
PID 5016 wrote to memory of 3260	5016	SecurityHealthService.exe	132
PID 5016 wrote to memory of 3260	5016	SecurityHealthService.exe	132
PID 5016 wrote to memory of 4600	5016	SecurityHealthService.exe	134
PID 5016 wrote to memory of 4600	5016	SecurityHealthService.exe	134
PID 5016 wrote to memory of 4600	5016	SecurityHealthService.exe	134
PID 5016 wrote to memory of 3880	5016	SecurityHealthService.exe	138
PID 5016 wrote to memory of 3880	5016	SecurityHealthService.exe	138
PID 5016 wrote to memory of 3880	5016	SecurityHealthService.exe	138
PID 5016 wrote to memory of 4552	5016	SecurityHealthService.exe	140
PID 5016 wrote to memory of 4552	5016	SecurityHealthService.exe	140
PID 5016 wrote to memory of 4552	5016	SecurityHealthService.exe	140

C:\Users\Admin\AppData\Local\Temp\4b33f2982aa4df81f65b713a7e398b3c.exe
"C:\Users\Admin\AppData\Local\Temp\4b33f2982aa4df81f65b713a7e398b3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\4b33f2982aa4df81f65b713a7e398b3c.exe
  "C:\Users\Admin\AppData\Local\Temp\4b33f2982aa4df81f65b713a7e398b3c.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\\main.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\main.exe
      C:\\main.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        
        "C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:2944
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:1704
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:1288
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:748
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:2408
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:1056
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3316
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4868
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:1652
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:3836
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:2344
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4180
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:1128
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:1744
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3260
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4600
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3880
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4552
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:2556
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:988
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:4484
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:2520
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3916
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:100
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:3372
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:812
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4756
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:1888
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:4996
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:756
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:1104
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:2032
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:3816
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:4276
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:808
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3280
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:3532
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:3304
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:3992
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "SecurityHealthService" /f
        6⤵
        
        PID:4892
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
        6⤵
        Creates scheduled task(s)
        
        PID:2688

C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe
1⤵
- Executes dropped EXE
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthService.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SecurityHealthService.exe.log
Size 319B
SHA256 7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
MD5 da4fafeffe21b7cb3a8c170ca7911976
SHA1 50ef77e2451ab60f93f4db88325b897d215be5ad
SHA512 0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\_bz2.pyd
Size 84KB
SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
MD5 e91b4f8e1592da26bacaceb542a220a8
SHA1 5459d4c2147fa6db75211c3ec6166b869738bd38
SHA512 cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9
SSDEEP 1536:5XZb8z78wjtQYeO9vDTwE0UaDnV8AQ6HiI37mZIyMVm/yH:5pAzjXeovDsE0UaDnaAQ6HiI3SZIyMVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\_decimal.pyd
Size 264KB
SHA256 df19c2e6ec3145166fa8d206c11db78bc1979a027105c4f21d40410b5082ba34
MD5 65287fd87a64bc756867a1afddec9e29
SHA1 cda1db353f81df7a4a818add8f87bca9ac840455
SHA512 3e3f19cf965b260ffc68e45d5101234e8a957411c076a0d487d307dcfa714a9801cb501224fe7621937aebdf90275f655c8a70dd6675bcfb5374404fda53236f
SSDEEP 6144:1y+R2gXaCSVl9yYWDKsSaHlbVTimGDIrfp/AQx9qWMa3pLW1Aqe36bMNrCb:fXaCSr9kDjv//0OnDrCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\_hashlib.pyd
Size 64KB
SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
MD5 7c69cb3cb3182a97e3e9a30d2241ebed
SHA1 1b8754ff57a14c32bcadc330d4880382c7fffc93
SHA512 96dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e
SSDEEP 768:Pyz+AYBOBSFlUx/tF5IzZL0fpde9E9GD2Fe7POoJp3RIyYIeqDG4yvOhz:QfBSbyFy1kumGM4Oo/RIyYIeuyvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\_lzma.pyd
Size 159KB
SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
MD5 493c33ddf375b394b648c4283b326481
SHA1 59c87ee582ba550f064429cb26ad79622c594f08
SHA512 a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2
SSDEEP 3072:ajV4pA1vcDRI45a4I9ihQsDPGAznfo9mNo6ndir1NZIyD1UsVM:ajV4pA10Dj5azDePlwYO6cr1NFVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\_socket.pyd
Size 78KB
SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
MD5 fd1cfe0f0023c5780247f11d8d2802c9
SHA1 5b29a3b4c6edb6fa176077e1f1432e3b0178f2bc
SHA512 b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae
SSDEEP 1536:AeG2cHel7zjv5Qe9AM9/s+m+p7ncSrpZjxk1IyBwayyq:3IyzjeMAM9/sb+p4Srbji1IyBwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\base_library.zip
Size 826KB
SHA256 151a4c8ea261130b5ae94653e5470ac6fe4663de269c187b2b38d6fccadc1baa
MD5 2abe470164e060916c6842da1263e5ad
SHA1 197163bfb26ce54420fa6eba03cf0fa0a5622934
SHA512 01e2c58b24f7d3d7b31df97c6dbe8aee0c0f61f457c78d62830fa954c17dffb74b4e5389ef389926b5ba78f96deb08ad4cd61c9ecea256bf35e0a99cd2366d65
SSDEEP 24576:Phia1OtQcosQNRs54PK4ItaVwHEfVEZIwE0G:Phia1OicosQNRs54PK4IpQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\libcrypto-1_1.dll
Size 3.2MB
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
SSDEEP 98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\main.zip
Size 65KB
SHA256 52507bc59bce399e5db789241fcc171a2ca5c868a8c2c985d3e02364af1a4990
MD5 e87566acf4ca1c9983971705a6c60906
SHA1 895740f5e3a9e70f720092946fc1e883466a26bc
SHA512 0bcd79fcdfc1490f8f5078bc12bd6c11ff7d66c875c95523a64fd8df63deb94f83046247ff2823f25eac7b70920180cac50a90130bc03470249595dbf97284d4
SSDEEP 1536:bMK7LJgzs/lonbGEA6lkmYCodovOWi1LMM6hcmejqO473w6JpTk:ngzs/iyED2PJdomWP5ZeuO4Tw60
MD5 SHA1 SHA512 SSDEEP

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\python39.dll
Size 4.3MB
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\select.pyd
Size 28KB
SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
MD5 0e3cf5d792a3f543be8bbc186b97a27a
SHA1 50f4c70fce31504c6b746a2c8d9754a16ebc8d5e
SHA512 224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340
SSDEEP 384:+Wu7bFYpo5K98HhIJg6mwhY6HqMGXYPAr70cE9o1IymGpMDG4y8lVJhj/:nykc6mwhBHqFY8p1IymGpMDG4yKhL
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40722\unicodedata.pyd
Size 1.1MB
SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
MD5 7af51031368619638cca688a7275db14
SHA1 64e2cc5ac5afe8a65af690047dc03858157e964c
SHA512 fbde24501288ff9b06fc96faff5e7a1849765df239e816774c04a4a6ef54a0c641adf4325bfb116952082d3234baef12288174ad8c18b62407109f29aa5ab326
SSDEEP 12288:lezMmuZ63NNQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uB/v:lezumZV0m88MMREtV6Vo4uYB/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.exe

Path C:\main.exe
Size 65KB
SHA256 21f539d71ad30ea865ccf0ee4dfdf6322b4895ce2cf8af67f120c2dfc84af33b
MD5 fef0fb51e5e35ca9244420c7675bb346
SHA1 ed4284dc3642bf59f8301b68b48fbb03ad5387f3
SHA512 66ec13dedfad899f29a5676ae6cb06d5eb357a8b31806154d91764069f748f1f4f5eb479211029bc72f0ee7b1dc3628ba5a8bb0a7e376d37bd4d94c18fb0f043
SSDEEP 1536:TYU4MoN36tCQviFw1q2tj+BnvbxmfLteF3nLrB9z3nR6aF9bxS9vM:TYU4MoN36tCQviFCTQBntmfWl9zEaF9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2848-32-0x00000000745C2000-0x00000000745C3000-memory.dmp

Download

memory/2848-34-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

memory/2848-33-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

memory/2848-44-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

memory/5016-45-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

memory/5016-46-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

memory/5016-50-0x00000000745C0000-0x0000000074B71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads