Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 11:05

General

  • Target

    Versatools.exe

  • Size

    37.8MB

  • MD5

    3266fa2e2db0f6d3328ae32de4a64c0c

  • SHA1

    8cfe11a04008c3c8ffbaae5283e5577e52c88120

  • SHA256

    f23fd2d73cb23edfadd7c92456767d8b9310e063d6e2410b40946be4fbe58eb3

  • SHA512

    965fe6ebcc5e5b5cb758dc1ca80faeda48e68acaf5d525c9c5722376626897687d5bf1dc671b96bb42745fe520a91240755c8dd83872ba06ff543add8b242d0a

  • SSDEEP

    786432:+WQtsdQEWl2j6+s7LWB75zuzWmSDGhQCzjE+/YLKbn0H5+o0:FQtEQJl2qHWB75izWmxjYm0b0

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Versatools.exe
    "C:\Users\Admin\AppData\Local\Temp\Versatools.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\Versatools.exe
      "C:\Users\Admin\AppData\Local\Temp\Versatools.exe"
      2⤵
      • Loads dropped DLL
      PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI29802\python311.dll

    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

  • C:\Users\Admin\AppData\Local\Temp\_MEI29802\ucrtbase.dll

    Filesize

    987KB

    MD5

    d40325e6c994228a3403f8ba8f24601f

    SHA1

    6266b5dc2001ffd75da3588dd7c43027a706589d

    SHA256

    a2ab58e44828009f6dafe54dd5ed57edfa6b09641e3c8eaa473b37e5b0e2b862

    SHA512

    59e712713d6492fa1b002da34bc9db82a85e19d13b694b77b57db1030681432c41705d56e9f75031ed9522d43a344d1475c745af7c8c92f70f7fc78e8b8895f9

  • \Users\Admin\AppData\Local\Temp\_MEI29802\api-ms-win-core-file-l1-2-0.dll

    Filesize

    13KB

    MD5

    e36ac4af8b02564857edaa68e2bbe1c0

    SHA1

    b6b379261b5432b019b4182b7be50ae61c1fd06e

    SHA256

    4237c0d089329b605d5416dae4005e1c4808a284b51dbaafe07a4b2cc7fcfb00

    SHA512

    61a6b2cd08ee54765d9ec6d2d1ae1b898b40a718eee022c74300a1c640afc7bbb43e7269e3caf42703991507e354566aca6923ea9e32bb513f4a1504feff2e4a

  • \Users\Admin\AppData\Local\Temp\_MEI29802\api-ms-win-core-file-l2-1-0.dll

    Filesize

    13KB

    MD5

    e8bdf021f69a63aa761ee231ace7efbe

    SHA1

    f1ba959f0c196748c9fd7a81f4b626075fd8afe9

    SHA256

    d0d8495562a6c8b7f6d68dcd9dbd096dc5b68a5f337b7fd0b1fea60014c25adb

    SHA512

    f16dfc423cfa60c11d215db3448b93c7f3b405f96002ba636068f51f2de1971b4ccd8b020fad1b761ab82e8692a80872668d0baf9a560ad012f30ae440d73c81

  • \Users\Admin\AppData\Local\Temp\_MEI29802\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    15KB

    MD5

    7f1ee2e33c903c7ea23dc80a19d6ec3c

    SHA1

    5e533f79dd14268c42e426efb1d3c3d29106e47e

    SHA256

    2ae12476304e22e7f31c71398fcf0acb626a6b44b37a7f68b6357cd049567d2f

    SHA512

    266f0337c1ea2c39b6248c5db9b8f500dca7664c11e72abcf37b3e04b541ec8f7efa84d46980c0bf007cdc8df726703de5bb04bc7c62da4e99d354d7cb4cafaa

  • \Users\Admin\AppData\Local\Temp\_MEI29802\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    13KB

    MD5

    92233d5f2057a6c99939e1549c8a63ab

    SHA1

    3e9a3b9e362025410d69458727462bb6338198f0

    SHA256

    6fe93c03cb84c7be2e8ef5c12f6c1595861c78edd1e099137f0c0866dc2fa5d0

    SHA512

    9aff968531a3cab229b3b5d216299149bf6ecf03086c5ddbe5a09ed52b62434ceffcf245be6306d7308e478acc5c445e1a6494491c0e8627818ec2472ce052fb

  • \Users\Admin\AppData\Local\Temp\_MEI29802\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    13KB

    MD5

    49100ae18d47b3a944205adb0820ff90

    SHA1

    5ecd49104c4f5c15a4147bfee35c6b9ac1291d0f

    SHA256

    53ecaca6e272bb4b283013a76a23004f8fa5bc0340d171b764c2bbd856e26a1f

    SHA512

    899a5b3f1b9a93db634507bde71be8157acba6fac4af3d35d08fca598a7cf6dc5c5d16fa122493a0516c13a22466909165ff94ef99ec9f394cbf2f2ced7a82cc