Malware Analysis Report

2025-05-05 21:32

Sample ID 240529-pvcy8see5s
Target @ST2.exe
SHA256 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2

Threat Level: Shows suspicious behavior

The file @ST2.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Detects Pyinstaller

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-29 12:38

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 12:38

Reported

2024-05-29 12:41

Platform

win7-20240221-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\@ST2.exe

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

C:\Users\Admin\AppData\Local\Temp\@ST2.exe

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI22122\DDRI.exe.manifest

MD5 c45ceb39869647b4dfb14c93837a9c4e
SHA1 f8405099a4b6f6d2994e19ec79e5dee27476d45b
SHA256 ad05c3f3250c6331d05fb023ac760b6903f2105533ed5fa557a8bf986bfe0fa4
SHA512 3db3f0d47be2485035d343d017f7c9b6e3786fb1ef7eae3234c2a215b218185f6b61fa17b75d8a1f6a33c0644871e4087b5a2ee192b99979e73def4600029553

C:\Users\Admin\AppData\Local\Temp\_MEI22122\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\Users\Admin\AppData\Local\Temp\_MEI22122\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\Users\Admin\AppData\Local\Temp\_MEI22122\base_library.zip

MD5 b832d0341e7ee9cca8c3876e0d2b3a6c
SHA1 9428352a483bd1f024bfbb787daa78de73729951
SHA256 b45fd442005c89134f2c876a22534166568210cbfc15e5bc1bfe94865eab85ff
SHA512 c4fbed156d6c9a2d3d776d1e22b84afc7c360f3a80bddef50dc4afe05d226ceca931a37be3a83ff78025c247046783380ef4a23f4f0fca2c9a75d91d18c83cd3

C:\Users\Admin\AppData\Local\Temp\_MEI22122\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 12:38

Reported

2024-05-29 12:41

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe C:\Users\Admin\AppData\Local\Temp\@ST2.exe
PID 4832 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe C:\Users\Admin\AppData\Local\Temp\@ST2.exe
PID 4832 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\@ST2.exe C:\Users\Admin\AppData\Local\Temp\@ST2.exe

Processes

C:\Users\Admin\AppData\Local\Temp\@ST2.exe

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

C:\Users\Admin\AppData\Local\Temp\@ST2.exe

"C:\Users\Admin\AppData\Local\Temp\@ST2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI48322\DDRI.exe.manifest

MD5 c45ceb39869647b4dfb14c93837a9c4e
SHA1 f8405099a4b6f6d2994e19ec79e5dee27476d45b
SHA256 ad05c3f3250c6331d05fb023ac760b6903f2105533ed5fa557a8bf986bfe0fa4
SHA512 3db3f0d47be2485035d343d017f7c9b6e3786fb1ef7eae3234c2a215b218185f6b61fa17b75d8a1f6a33c0644871e4087b5a2ee192b99979e73def4600029553

C:\Users\Admin\AppData\Local\Temp\_MEI48322\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\Users\Admin\AppData\Local\Temp\_MEI48322\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\Users\Admin\AppData\Local\Temp\_MEI48322\base_library.zip

MD5 b832d0341e7ee9cca8c3876e0d2b3a6c
SHA1 9428352a483bd1f024bfbb787daa78de73729951
SHA256 b45fd442005c89134f2c876a22534166568210cbfc15e5bc1bfe94865eab85ff
SHA512 c4fbed156d6c9a2d3d776d1e22b84afc7c360f3a80bddef50dc4afe05d226ceca931a37be3a83ff78025c247046783380ef4a23f4f0fca2c9a75d91d18c83cd3

C:\Users\Admin\AppData\Local\Temp\_MEI48322\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9