Analysis Overview
SHA256
721a4b64330caaa0a64de7a355c76add6f50a90ce6039fbb17a8db6ddfd8debc
Threat Level: Shows suspicious behavior
The file TBK_Mass_DM_1_1.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Detects Pyinstaller
Unsigned PE
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-26 01:03
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-26 01:03
Reported
2024-05-26 01:23
Platform
win10v2004-20240426-en
Max time kernel
453s
Max time network
1179s
Command Line
Signatures
Loads dropped DLL
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3644 wrote to memory of 4524 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe |
| PID 3644 wrote to memory of 4524 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe |
| PID 4524 wrote to memory of 5112 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Windows\system32\cmd.exe |
| PID 4524 wrote to memory of 5112 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Windows\system32\cmd.exe |
| PID 5112 wrote to memory of 552 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\mode.com |
| PID 5112 wrote to memory of 552 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\mode.com |
| PID 4524 wrote to memory of 3328 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Windows\system32\cmd.exe |
| PID 4524 wrote to memory of 3328 | N/A | C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe
"C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe"
C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe
"C:\Users\Admin\AppData\Local\Temp\TBK_Mass_DM_1_1.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c mode con cols=77 lines=27
C:\Windows\system32\mode.com
mode con cols=77 lines=27
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| N/A | 127.0.0.1:57308 | tcp | |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discordapp.com | udp |
| US | 162.159.129.233:443 | discordapp.com | tcp |
| US | 8.8.8.8:53 | 233.129.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.179.89.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI36442\python38.dll
| MD5 | d2a8a5e7380d5f4716016777818a32c5 |
| SHA1 | fb12f31d1d0758fe3e056875461186056121ed0c |
| SHA256 | 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9 |
| SHA512 | ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\base_library.zip
| MD5 | 802121028264cd071827a5ab62552092 |
| SHA1 | d622736c78fc64d6a1d3ca81572acacf06727cbc |
| SHA256 | 2f276b628f11077b78a78dd82df94eab300e68e562d3daa9a743458db0b3d047 |
| SHA512 | d4d77c2aa497aeef1e70dc82376e699b036c690c5ab78a2274ab5f943e1966109069c6b52b89586fb770387be88dcccc38e16df3dff1d94bfab5497e1f716ac7 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\VCRUNTIME140.dll
| MD5 | 0e675d4a7a5b7ccd69013386793f68eb |
| SHA1 | 6e5821ddd8fea6681bda4448816f39984a33596b |
| SHA256 | bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1 |
| SHA512 | cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_ctypes.pyd
| MD5 | f1e33a8f6f91c2ed93dc5049dd50d7b8 |
| SHA1 | 23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4 |
| SHA256 | 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4 |
| SHA512 | 229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\select.pyd
| MD5 | 6ae54d103866aad6f58e119d27552131 |
| SHA1 | bc53a92a7667fd922ce29e98dfcf5f08f798a3d2 |
| SHA256 | 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88 |
| SHA512 | ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_socket.pyd
| MD5 | d6bae4b430f349ab42553dc738699f0e |
| SHA1 | 7e5efc958e189c117eccef39ec16ebf00e7645a9 |
| SHA256 | 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef |
| SHA512 | a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\libcrypto-1_1.dll
| MD5 | bf83f8ad60cb9db462ce62c73208a30d |
| SHA1 | f1bc7dbc1e5b00426a51878719196d78981674c4 |
| SHA256 | 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d |
| SHA512 | ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\libssl-1_1.dll
| MD5 | fe1f3632af98e7b7a2799e3973ba03cf |
| SHA1 | 353c7382e2de3ccdd2a4911e9e158e7c78648496 |
| SHA256 | 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b |
| SHA512 | a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_overlapped.pyd
| MD5 | 1b04bd84bdd90b8419e2a658a1cacc6e |
| SHA1 | c016487aa0455a8bb664f306fb4ad3e7e64811f2 |
| SHA256 | 44f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4 |
| SHA512 | 24e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_bz2.pyd
| MD5 | 3dc8af67e6ee06af9eec52fe985a7633 |
| SHA1 | 1451b8c598348a0c0e50afc0ec91513c46fe3af6 |
| SHA256 | c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929 |
| SHA512 | da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_lzma.pyd
| MD5 | 37057c92f50391d0751f2c1d7ad25b02 |
| SHA1 | a43c6835b11621663fa251da421be58d143d2afb |
| SHA256 | 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764 |
| SHA512 | 953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\unicodedata.pyd
| MD5 | 4c0d43f1a31e76255cb592bb616683e7 |
| SHA1 | 0a9f3d77a6e064baebacacc780701117f09169ad |
| SHA256 | 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8 |
| SHA512 | b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_hashlib.pyd
| MD5 | a6448bc5e5da21a222de164823add45c |
| SHA1 | 6c26eb949d7eb97d19e42559b2e3713d7629f2f9 |
| SHA256 | 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a |
| SHA512 | a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\multidict\_multidict.cp38-win_amd64.pyd
| MD5 | 4d07e807a855be02a94c292dc66cb379 |
| SHA1 | 2d8d742a1179627f1fd702430c3ee106b72988aa |
| SHA256 | 6ccb02ca328a9df23d5f5c7ce58fbf7b9f84474c801230c6c42eab171ed83744 |
| SHA512 | 1576744a545abc7158525ec0e0e7930a7ed14016ce4d3ea157261e6be204a5e490937387718fe9b444f0d5ccfff866cd3426c1481ec31e293f59928d097895d1 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\yarl\_quoting_c.cp38-win_amd64.pyd
| MD5 | e96e99fc84249de9c4cd4649f3a27f7b |
| SHA1 | 4fcf885311d24a2ce438842bb7db269550709a00 |
| SHA256 | 3730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303 |
| SHA512 | 19aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_asyncio.pyd
| MD5 | fe9322e00324b59c179d4c9803322b6c |
| SHA1 | 4d27aa7b1d38ee633de49256bb26a9ee47eb9ef1 |
| SHA256 | 46967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb |
| SHA512 | 29d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_ssl.pyd
| MD5 | 8ee827f2fe931163f078acdc97107b64 |
| SHA1 | 149bb536f3492bc59bd7071a3da7d1f974860641 |
| SHA256 | eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4 |
| SHA512 | a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\libffi-7.dll
| MD5 | 4424baf6ed5340df85482fa82b857b03 |
| SHA1 | 181b641bf21c810a486f855864cd4b8967c24c44 |
| SHA256 | 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79 |
| SHA512 | 8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\certifi\cacert.pem
| MD5 | 3dcd08b803fbb28231e18b5d1eef4258 |
| SHA1 | b81ea40b943cd8a0c341f3a13e5bc05090b5a72a |
| SHA256 | de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e |
| SHA512 | 9cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI36442\_queue.pyd
| MD5 | 44b72e0ad8d1e1ec3d8722088b48c3c5 |
| SHA1 | e0f41bf85978dd8f5abb0112c26322b72c0d7770 |
| SHA256 | 4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e |
| SHA512 | 05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-26 01:03
Reported
2024-05-26 01:39
Platform
win10v2004-20240426-en
Max time kernel
457s
Max time network
1180s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tbk.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| BE | 88.221.83.187:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 187.83.221.88.in-addr.arpa | udp |
| BE | 88.221.83.187:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 138.201.86.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 52.111.229.48:443 | tcp | |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.64.52.20.in-addr.arpa | udp |