03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf

Analysis

max time kernel
150s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe
Size

6.0MB
MD5

1feaadc4ef680976de450846b86f64bb
SHA1

49540a6ae12c91c2cae4e7bed1fa4e338e6a2bba
SHA256

03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf
SHA512

0b69108768269a3fa28291d81ac78c42f33b111f7bdd641b558cb858f2421fc0ee9f34f8417c895f2fa7f1a23172129ac3cece897d32817ed02f9b6d380fa282
SSDEEP

98304:6PbWMBPF5kcwoPllMWHubXkTZONq0d6NlPf9//KJ+PUigzFGxchaNCYs6CfTL:+bTBWoP1HOXfZ8bntw+EFGxcmCYst

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4524	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe
4524	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe
4524	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4524	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4524	4532	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe	81
PID 4532 wrote to memory of 4524	4532	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe	81
PID 4532 wrote to memory of 4524	4532	03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe	81

C:\Users\Admin\AppData\Local\Temp\03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe
"C:\Users\Admin\AppData\Local\Temp\03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe
  "C:\Users\Admin\AppData\Local\Temp\03e4d7e75534971d4c4c956ffe0fa4f94aa95b698425ccea946ed363a1091daf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI45322\VCRUNTIME140.dll

Filesize
81KB

MD5
aeab74db6bc6c914997f1a8a9ff013ec

SHA1
6b717f23227d158d6aa566498c438b8f305a29b5

SHA256
18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b

SHA512
a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45322\_ctypes.pyd

Filesize
102KB

MD5
10861d3fa19d7dc3b41eb6f837340782

SHA1
b258d223b444ab994ec2fec95acaa9f82dc3938c

SHA256
6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1

SHA512
ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45322\base_library.zip

Filesize
763KB

MD5
e14d09dd7b6aab745e07669c897cea32

SHA1
14d43204d3107e7d5aa8aef287caa426b53197f5

SHA256
0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0

SHA512
ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45322\python37.dll

Filesize
3.3MB

MD5
465089eaced8159ec533e4a37033e227

SHA1
074596adae6f53f33b8297f02e21f6a6f7ac6ff1

SHA256
2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40

SHA512
55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads