Analysis Overview
SHA256
03208627588eaad236f593edc1eb2857db1377f235e8fbfbfdc1050da2303ebe
Threat Level: Shows suspicious behavior
The file 1cfa70c1b2f1eb15d9f6b0d502095360.bin was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Detects Pyinstaller
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-06-04 01:17
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-04 01:15
Reported
2024-06-04 01:20
Platform
win7-20240220-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe
"C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe"
C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe
"C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI29042\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
\Users\Admin\AppData\Local\Temp\_MEI29042\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI29042\base_library.zip
| MD5 | 914a404c865d813ef7acc4b420e195ec |
| SHA1 | cc952cac236b74bae6df82a9ee6ef9947c1b13ad |
| SHA256 | e3197bd0dc6e3437f5991d0387e64714aa25bd43ab6e4235a8f5517819535794 |
| SHA512 | 4b1934e7c2a084a744a01b94753e6ff223b7472ebf58bf1b894f7090357a756b6bd704b317a6d59eee43a12bf3c9fe7f03cdb99960126ce78f967af97b0b017d |
C:\Users\Admin\AppData\Local\Temp\_MEI29042\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-04 01:15
Reported
2024-06-04 01:20
Platform
win10v2004-20240508-en
Max time kernel
138s
Max time network
124s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe
"C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe"
C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe
"C:\Users\Admin\AppData\Local\Temp\139b21a0ba2e1d6e45cc7ce3494b25b57cb2d5405abe851c1086b24f7d7d2619.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI6722\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI6722\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI6722\base_library.zip
| MD5 | 914a404c865d813ef7acc4b420e195ec |
| SHA1 | cc952cac236b74bae6df82a9ee6ef9947c1b13ad |
| SHA256 | e3197bd0dc6e3437f5991d0387e64714aa25bd43ab6e4235a8f5517819535794 |
| SHA512 | 4b1934e7c2a084a744a01b94753e6ff223b7472ebf58bf1b894f7090357a756b6bd704b317a6d59eee43a12bf3c9fe7f03cdb99960126ce78f967af97b0b017d |
C:\Users\Admin\AppData\Local\Temp\_MEI6722\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |