Overview

overview

7

Static

static

3

svchost.exe

windows7-x64

7

svchost.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 09:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    svchost.exe
  • Size 7.8MB
  • Sample240607-le7xwsfc67
  • SHA256 437e0d18e60998bd0236dd5da5637a90ec3b6887f1eb25e6557a2354dc96404b
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4396

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\VCRUNTIME140.dll
        • Size 85KB
        • SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_bz2.pyd
        • Size 92KB
        • SHA256 8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cffi_backend.cp37-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_cffi_backend.cp37-win_amd64.pyd
        • Size 177KB
        • SHA256 b714423d9cad42e67937531f2634001a870f8be2bf413eacfc9f73ef391a7915
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_hashlib.pyd
        • Size 38KB
        • SHA256 ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_lzma.pyd
        • Size 172KB
        • SHA256 f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_queue.pyd
        • Size 27KB
        • SHA256 e499824d58570c3130ba8ef1ac2d503e71f916c634b2708cc22e95c223f83d0a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_socket.pyd
        • Size 75KB
        • SHA256 9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\_ssl.pyd
        • Size 118KB
        • SHA256 b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\base_library.zip
        • Size 1000KB
        • SHA256 980eab75d2e03b71fa4327da3a3126ad6980ff60a5cf9ad2b96ce06ad15ae3bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\certifi\cacert.pem
        • Size 279KB
        • SHA256 de5f02716b7fa8be36d37d2b1a2783dd22ee7c80855f46d8b4684397f11754f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _openssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\cryptography\hazmat\bindings\_openssl.pyd
        • Size 3.8MB
        • SHA256 da0dea85eb34de0e50ab1d343d33ed0a99b3af5e2f479d306fce5c0ed604b1d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\cryptography\hazmat\bindings\_rust.pyd
        • Size 1.6MB
        • SHA256 bca2dd906302a6a84e9aa5f41b06c4deef4fee139e861d5c538ba30bd4c40574
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\libssl-1_1.dll
        • Size 673KB
        • SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\python3.dll
        • Size 57KB
        • SHA256 d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python37.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\python37.dll
        • Size 3.6MB
        • SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\select.pyd
        • Size 26KB
        • SHA256 65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39562\unicodedata.pyd
        • Size 1.0MB
        • SHA256 016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download