Analysis Overview
SHA256
d99f7f4af6a60fb9ca54da915316439a14c308b19dd702a46943c028765ac16a
Threat Level: Shows suspicious behavior
The file 17484816636.zip was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Detects Pyinstaller
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-29 11:36
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-29 11:36
Reported
2024-05-29 11:39
Platform
win7-20240508-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI20362\DDRI.exe.manifest
| MD5 | c45ceb39869647b4dfb14c93837a9c4e |
| SHA1 | f8405099a4b6f6d2994e19ec79e5dee27476d45b |
| SHA256 | ad05c3f3250c6331d05fb023ac760b6903f2105533ed5fa557a8bf986bfe0fa4 |
| SHA512 | 3db3f0d47be2485035d343d017f7c9b6e3786fb1ef7eae3234c2a215b218185f6b61fa17b75d8a1f6a33c0644871e4087b5a2ee192b99979e73def4600029553 |
C:\Users\Admin\AppData\Local\Temp\_MEI20362\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI20362\base_library.zip
| MD5 | b832d0341e7ee9cca8c3876e0d2b3a6c |
| SHA1 | 9428352a483bd1f024bfbb787daa78de73729951 |
| SHA256 | b45fd442005c89134f2c876a22534166568210cbfc15e5bc1bfe94865eab85ff |
| SHA512 | c4fbed156d6c9a2d3d776d1e22b84afc7c360f3a80bddef50dc4afe05d226ceca931a37be3a83ff78025c247046783380ef4a23f4f0fca2c9a75d91d18c83cd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI20362\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-29 11:36
Reported
2024-05-29 11:39
Platform
win10v2004-20240426-en
Max time kernel
147s
Max time network
94s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3348 wrote to memory of 1364 | N/A | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe |
| PID 3348 wrote to memory of 1364 | N/A | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe |
| PID 3348 wrote to memory of 1364 | N/A | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe | C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI33482\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI33482\DDRI.exe.manifest
| MD5 | c45ceb39869647b4dfb14c93837a9c4e |
| SHA1 | f8405099a4b6f6d2994e19ec79e5dee27476d45b |
| SHA256 | ad05c3f3250c6331d05fb023ac760b6903f2105533ed5fa557a8bf986bfe0fa4 |
| SHA512 | 3db3f0d47be2485035d343d017f7c9b6e3786fb1ef7eae3234c2a215b218185f6b61fa17b75d8a1f6a33c0644871e4087b5a2ee192b99979e73def4600029553 |
C:\Users\Admin\AppData\Local\Temp\_MEI33482\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI33482\base_library.zip
| MD5 | b832d0341e7ee9cca8c3876e0d2b3a6c |
| SHA1 | 9428352a483bd1f024bfbb787daa78de73729951 |
| SHA256 | b45fd442005c89134f2c876a22534166568210cbfc15e5bc1bfe94865eab85ff |
| SHA512 | c4fbed156d6c9a2d3d776d1e22b84afc7c360f3a80bddef50dc4afe05d226ceca931a37be3a83ff78025c247046783380ef4a23f4f0fca2c9a75d91d18c83cd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI33482\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |