Malware Analysis Report

2024-11-30 13:35

Sample ID 240604-fhykqsec74
Target 17524385326.zip
SHA256 0e4f539b03dd958e671132b5ef330658abce425fd942483195191f4e0f443830
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0e4f539b03dd958e671132b5ef330658abce425fd942483195191f4e0f443830

Threat Level: Shows suspicious behavior

The file 17524385326.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Detects Pyinstaller

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-04 04:53

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 04:53

Reported

2024-06-04 04:58

Platform

win7-20240215-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI15122\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\Users\Admin\AppData\Local\Temp\_MEI15122\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\Users\Admin\AppData\Local\Temp\_MEI15122\base_library.zip

MD5 e14d09dd7b6aab745e07669c897cea32
SHA1 14d43204d3107e7d5aa8aef287caa426b53197f5
SHA256 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0
SHA512 ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a

\Users\Admin\AppData\Local\Temp\_MEI15122\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 04:53

Reported

2024-06-04 04:58

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe

"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI49362\python37.dll

MD5 465089eaced8159ec533e4a37033e227
SHA1 074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA256 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA512 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81

C:\Users\Admin\AppData\Local\Temp\_MEI49362\VCRUNTIME140.dll

MD5 aeab74db6bc6c914997f1a8a9ff013ec
SHA1 6b717f23227d158d6aa566498c438b8f305a29b5
SHA256 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512 a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036

C:\Users\Admin\AppData\Local\Temp\_MEI49362\base_library.zip

MD5 e14d09dd7b6aab745e07669c897cea32
SHA1 14d43204d3107e7d5aa8aef287caa426b53197f5
SHA256 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0
SHA512 ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a

C:\Users\Admin\AppData\Local\Temp\_MEI49362\_ctypes.pyd

MD5 10861d3fa19d7dc3b41eb6f837340782
SHA1 b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA256 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512 ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9