Analysis
- max time kernel
117s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
06/06/2024, 07:04
Behavioral task
behavioral1
Sample
tbk.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
tbk.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tbk.pyc
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
tbk.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target tbk.exe
- Size 7.4MB
- Sample240606-hwe2naba61
- SHA256 721a4b64330caaa0a64de7a355c76add6f50a90ce6039fbb17a8db6ddfd8debc
- MD5 c4f886d3b4ce022c73dff1312b5e6d2a
- SHA1 e9c2e75578956fd75dd60765c968b9ce1023073b
- SHA512 806a1b1c4f021d49735d7686de5bd0c3ef8f64d50761ba1ed58ea3c80fc4ff141c62aed6adcefb359c563f6e45733d60892e64a636cd3c3f99432b46d9d84687
- SSDEEP 196608:f+24uWJysVYvsOSVoyMxxvjDDAx4Br/nKsM/d0kkS2hTyZpMTx:DWJzoyMxtDDAxmxM/d0k1myZpMT
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 18 IoCs
pid Process 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe 2564 tbk.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2564 2104 tbk.exe 29 PID 2104 wrote to memory of 2564 2104 tbk.exe 29 PID 2104 wrote to memory of 2564 2104 tbk.exe 29 PID 2564 wrote to memory of 2524 2564 tbk.exe 30 PID 2564 wrote to memory of 2524 2564 tbk.exe 30 PID 2564 wrote to memory of 2524 2564 tbk.exe 30 PID 2524 wrote to memory of 2412 2524 cmd.exe 31 PID 2524 wrote to memory of 2412 2524 cmd.exe 31 PID 2524 wrote to memory of 2412 2524 cmd.exe 31 PID 2564 wrote to memory of 2444 2564 tbk.exe 32 PID 2564 wrote to memory of 2444 2564 tbk.exe 32 PID 2564 wrote to memory of 2444 2564 tbk.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\tbk.exe"C:\Users\Admin\AppData\Local\Temp\tbk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\tbk.exe"C:\Users\Admin\AppData\Local\Temp\tbk.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con cols=77 lines=273⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\system32\mode.commode con cols=77 lines=274⤵PID:2412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:2444
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\VCRUNTIME140.dll
- Size 87KB
- SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
- MD5 0e675d4a7a5b7ccd69013386793f68eb
- SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
- SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
- SSDEEP 1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_asyncio.pyd
- Size 62KB
- SHA256 46967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb
- MD5 fe9322e00324b59c179d4c9803322b6c
- SHA1 4d27aa7b1d38ee633de49256bb26a9ee47eb9ef1
- SHA512 29d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8
- SSDEEP 768:uPSCpfIUMc/2FqpIUpv4qvTNsVqMqBtmDxN7RMjxIGsnzrWDG4yAI:uXaHc/+23GqCFxN76xIGsnCyAI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_ctypes.pyd
- Size 120KB
- SHA256 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
- MD5 f1e33a8f6f91c2ed93dc5049dd50d7b8
- SHA1 23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4
- SHA512 229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5
- SSDEEP 3072:qpG85kJGmH3c+5M333KvUPzeENGLf3Tz4ccUZw1IGVPE:qDSGT+5+KMPzyLf3TEcKu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_hashlib.pyd
- Size 44KB
- SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
- MD5 a6448bc5e5da21a222de164823add45c
- SHA1 6c26eb949d7eb97d19e42559b2e3713d7629f2f9
- SHA512 a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba
- SSDEEP 768:8skeCps0iszzPFrGE/CBAdIPGV03ju774xxIGsIx7WDG4yw:81eCpLzDBZ+AdIPmYju7OxIGsIxWyw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_lzma.pyd
- Size 246KB
- SHA256 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
- MD5 37057c92f50391d0751f2c1d7ad25b02
- SHA1 a43c6835b11621663fa251da421be58d143d2afb
- SHA512 953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c
- SSDEEP 6144:bkHDwqjhhwYbOqQNEkT/4OQhJwAbHoqLNvka/gOFhUw6b4qCNxkV/3OdhAWwPbGE:bd7/IbtSKOt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_overlapped.pyd
- Size 44KB
- SHA256 44f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4
- MD5 1b04bd84bdd90b8419e2a658a1cacc6e
- SHA1 c016487aa0455a8bb664f306fb4ad3e7e64811f2
- SHA512 24e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3
- SSDEEP 768:sn4ZRc0uTZceAO/eVctyroYWEQR7/7i13rstIGJtMkWDG4yMO:sn4ZI1ZAO/xvR7/7iBQtIGJtMRyMO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_queue.pyd
- Size 27KB
- SHA256 4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e
- MD5 44b72e0ad8d1e1ec3d8722088b48c3c5
- SHA1 e0f41bf85978dd8f5abb0112c26322b72c0d7770
- SHA512 05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c
- SSDEEP 384:bp/aC60HGTPk/ltSA/6rCbCnA/cEXEz65D1IGqUrnYPLxDG4y8xxzzI:bH60HGw/b/6rCb9iKD1IGqUrWDG4yCI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_socket.pyd
- Size 77KB
- SHA256 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
- MD5 d6bae4b430f349ab42553dc738699f0e
- SHA1 7e5efc958e189c117eccef39ec16ebf00e7645a9
- SHA512 a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e
- SSDEEP 1536:KzMe79sDb+eGm08Vr5lcDAB9/s+7+pkaOz3CkNA9y1IGVwCyMPbi:de79u8/GFmAB9/se+pROz3jN1IGVw+Pm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\_ssl.pyd
- Size 115KB
- SHA256 eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4
- MD5 8ee827f2fe931163f078acdc97107b64
- SHA1 149bb536f3492bc59bd7071a3da7d1f974860641
- SHA512 a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565
- SSDEEP 3072:x3xozhUCVgMUGSo5iY0nx2bsxSV3QilzQmxLZIG47HZ:p6zh72PGz0nxrmVG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\base_library.zip
- Size 758KB
- SHA256 2f276b628f11077b78a78dd82df94eab300e68e562d3daa9a743458db0b3d047
- MD5 802121028264cd071827a5ab62552092
- SHA1 d622736c78fc64d6a1d3ca81572acacf06727cbc
- SHA512 d4d77c2aa497aeef1e70dc82376e699b036c690c5ab78a2274ab5f943e1966109069c6b52b89586fb770387be88dcccc38e16df3dff1d94bfab5497e1f716ac7
- SSDEEP 12288:Zihid7QIKeZU+3bKOtosQNRs54PK4IMAUVVw596fCEZZBQBsUR32g:khidrxtosQNRs54PK4IM1Vw596fCEZ3m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\certifi\cacert.pem
- Size 253KB
- SHA256 de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e
- MD5 3dcd08b803fbb28231e18b5d1eef4258
- SHA1 b81ea40b943cd8a0c341f3a13e5bc05090b5a72a
- SHA512 9cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5
- SSDEEP 6144:fW1H7M8f9Z0mNplX4XCRrcMFADwYCuMsligT/Q5Ml:fWN7vZLNLqCRrctb65Ml
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\libcrypto-1_1.dll
- Size 3.2MB
- SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
- MD5 bf83f8ad60cb9db462ce62c73208a30d
- SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
- SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
- SSDEEP 49152:Y4TKuk29SIU6i5fOjPWl+0rOh5PKToEGG9I+q4dNQbZQm9aGupuu9LoeiyPaRb84:YiV+CGQ4dtBMeiJRb8+1CPwDv3uFZjN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\libffi-7.dll
- Size 32KB
- SHA256 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
- MD5 4424baf6ed5340df85482fa82b857b03
- SHA1 181b641bf21c810a486f855864cd4b8967c24c44
- SHA512 8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33
- SSDEEP 384:JYnlpDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYPoBhT/A4:JYe0Vn5Q28J8qsqMttktuTSTWDG4yhRe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\libssl-1_1.dll
- Size 670KB
- SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
- MD5 fe1f3632af98e7b7a2799e3973ba03cf
- SHA1 353c7382e2de3ccdd2a4911e9e158e7c78648496
- SHA512 a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0
- SSDEEP 12288:3L6MSpHovlo4qL7a3ZV9CblMOoAXToRtrBZf3Fb85BO9K9pB3TLPDdOU2lvz8:wIAL7a3heSFZf2Pq63HJOU2lvz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\multidict\_multidict.cp38-win_amd64.pyd
- Size 43KB
- SHA256 6ccb02ca328a9df23d5f5c7ce58fbf7b9f84474c801230c6c42eab171ed83744
- MD5 4d07e807a855be02a94c292dc66cb379
- SHA1 2d8d742a1179627f1fd702430c3ee106b72988aa
- SHA512 1576744a545abc7158525ec0e0e7930a7ed14016ce4d3ea157261e6be204a5e490937387718fe9b444f0d5ccfff866cd3426c1481ec31e293f59928d097895d1
- SSDEEP 384:/yUgT22q3N5NcEYiRFcXdYLzXjTXvRiNNzXBNrOV1imtooY3ht5J6RPP3Prs3Tzi:/drEEedYLNiN9uTah7JU4hRZqN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\python38.dll
- Size 4.0MB
- SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
- MD5 d2a8a5e7380d5f4716016777818a32c5
- SHA1 fb12f31d1d0758fe3e056875461186056121ed0c
- SHA512 ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7
- SSDEEP 49152:wV6CJES/Za2BaobNruDPYRQYK8JCNNtkAz+/Q46VqNo9NYxwCFIInKHJCMjntPNj:MxB/aDUQNtufeNFIKHoMjzkDU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\select.pyd
- Size 26KB
- SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
- MD5 6ae54d103866aad6f58e119d27552131
- SHA1 bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
- SHA512 ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0
- SSDEEP 768:6kYtqIDCNdwhBfAqXuqzz5H1IGqGbWDG4y4:6TnDCNCh93X7zzR1IGqG2y4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\unicodedata.pyd
- Size 1.0MB
- SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
- MD5 4c0d43f1a31e76255cb592bb616683e7
- SHA1 0a9f3d77a6e064baebacacc780701117f09169ad
- SHA512 b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778
- SSDEEP 12288:EGe9qQOZ67191SnFRFotduNFBjCmN/XlyCAx9++bBlhJk93cgewrxEeBc0bB:EGe9GK4oYhCc/+9nbDhG2wrxc0bB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI21042\yarl\_quoting_c.cp38-win_amd64.pyd
- Size 78KB
- SHA256 3730432069213e61d347d65be318c32a81dfebc56397de6a900c0b71f2aea303
- MD5 e96e99fc84249de9c4cd4649f3a27f7b
- SHA1 4fcf885311d24a2ce438842bb7db269550709a00
- SHA512 19aa039867085a5bba72308f514a614ba4703cc1299d6367b20d6ae7573f44a944f4ab46e3ea751e8a7bc63ebb97bf4fd32e60c480f31c4f9ff425725b690f79
- SSDEEP 768:r1SIM4gG9GZZ4V89KOXwFGEdYh1l8JDnIxJBaQ5ZKauDt4dwB2/+GRKhc49YcRWy:r1ZGUVcwFwrFdwTGj4vRWn297sC
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI21042\_bz2.pyd
- Size 82KB
- SHA256 c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
- MD5 3dc8af67e6ee06af9eec52fe985a7633
- SHA1 1451b8c598348a0c0e50afc0ec91513c46fe3af6
- SHA512 da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087
- SSDEEP 1536:SSpo7/9ZwseNsUQJ8rbXis0WwOpcAE+8aoBnuRtApxbBVZIG4VJyI:SSW7lZws+bLwOpvEZa+uRWVVZIG4VF
- MD5 SHA1 SHA512 SSDEEP