Analysis

  • max time kernel
    132s
  • max time network
    138s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/06/2024, 11:09

General

  • Target
    capa.exe
  • Size 31.2MB
  • Sample240609-m9m2msae43
  • SHA256 9e3383e156bcbb0b845fd2187f9ce585db58ba31d1c5a139d1fa4e9183a5e9de
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\capa.exe
    "C:\Users\Admin\AppData\Local\Temp\capa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\capa.exe
      "C:\Users\Admin\AppData\Local\Temp\capa.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:1728

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\VCRUNTIME140.dll
          • Size 93KB
          • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
          • MD5 SHA1 SHA512 SSDEEP

          _asyncio.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_asyncio.pyd
          • Size 63KB
          • SHA256 6e25aa5931f175b971dfd05aab7a24cef29edd8f4b524341c414d0577c07a200
          • MD5 SHA1 SHA512 SSDEEP

          _ctypes.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_ctypes.pyd
          • Size 124KB
          • SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
          • MD5 SHA1 SHA512 SSDEEP

          _decimal.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_decimal.pyd
          • Size 262KB
          • SHA256 30eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
          • MD5 SHA1 SHA512 SSDEEP

          _elementtree.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_elementtree.pyd
          • Size 175KB
          • SHA256 00d68d3879ab410601e7e8fb2348d4995cec2ee78b3a07ea59520d35f9953bb4
          • MD5 SHA1 SHA512 SSDEEP

          _hashlib.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_hashlib.pyd
          • Size 46KB
          • SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
          • MD5 SHA1 SHA512 SSDEEP

          _multiprocessing.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_multiprocessing.pyd
          • Size 29KB
          • SHA256 54c28dcf2f2a72fc854f49c76fb021bbf2b53675fe5b5ed021c61efe9467197b
          • MD5 SHA1 SHA512 SSDEEP

          _overlapped.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\_overlapped.pyd
          • Size 45KB
          • SHA256 5f92c163b9fe6abb0f8b106a972f6a86f84271b2e32c67f95737387c85719837
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-console-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-console-l1-1-0.dll
          • Size 13KB
          • SHA256 0086c2409ca8fca1b7fe42972b60f937f846e60a938a5989129f68b8b41c77f2
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-datetime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-datetime-l1-1-0.dll
          • Size 13KB
          • SHA256 88d783199b25d350968b6ccd0c8240991587b7ae810c744dfa2ec62d8e9cb072
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-debug-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-debug-l1-1-0.dll
          • Size 13KB
          • SHA256 326e33a52024cf4f16d717c74875b45f9d72ce5036e563ddc71163d092819e55
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-errorhandling-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 13KB
          • SHA256 0857f0669237f4c8f85dca01acc7af0f654029832752c54d518cb741fd709878
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-file-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-file-l1-1-0.dll
          • Size 16KB
          • SHA256 22967506ae7e13fd6afc9cbe6aa7d14f497c37a40684fbfd7a5146b9f1569646
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-file-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-file-l1-2-0.dll
          • Size 13KB
          • SHA256 fb9b51ab73cb5fecc491a3a2624d54cc327370c6ac5efc9dfada2411acf766ed
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-file-l2-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-file-l2-1-0.dll
          • Size 13KB
          • SHA256 5747de24ef2014b50f49d541621a328a02a4ef5f20eeb94423a3d7f7954e49f6
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-handle-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-handle-l1-1-0.dll
          • Size 13KB
          • SHA256 0d520c708ea21b4120660e3b2db833f473c193508649c57d759452f19d6e633a
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-heap-l1-1-0.dll
          • Size 13KB
          • SHA256 5e3a6502b929df2cbfd6c9e0bfc2016b082e72246dc033655957aeaf812f5119
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-interlocked-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 13KB
          • SHA256 1e72f74bdc5edc4ef93bced9065fd1ce3d20d891a6933c068d8a8bb97f813870
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-libraryloader-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 14KB
          • SHA256 1eacc48d19f44e5dd54e4ea0a2f77a3130ecaacf22605595f3c6b6e398b9d2d8
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-localization-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-localization-l1-2-0.dll
          • Size 15KB
          • SHA256 dd36f8e544be435ffd7c96ddb077dc76b4cebd6fbef14319f7d21f47fe794a87
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-memory-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-memory-l1-1-0.dll
          • Size 13KB
          • SHA256 bac0e15f62d2aad8af2d9564d15c987d707ee4c5021fdb308287e1a63a6116fc
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-namedpipe-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 13KB
          • SHA256 a322178a86629cce8ecfe5c88518f874afa7903a30bc26edc6f1989d087ae726
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-processenvironment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 14KB
          • SHA256 b3b48223093c2b210f76fd38d3d70b9c0bd17834c2762d1172bee7f12411512f
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-processthreads-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 15KB
          • SHA256 70a96238fe9b62eb195d1f1553624fbc45b52cc12dc7193913e6e65c71e09321
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-processthreads-l1-1-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 13KB
          • SHA256 257d25b17680639ef9175e272c2cec4239a395651a69115441ba234c4b30ec0b
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-profile-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-profile-l1-1-0.dll
          • Size 12KB
          • SHA256 516d34cafdfbdf5e89804fe2b9c995f23fac93672ab1de9cffa55f6bdb0d1e24
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-rtlsupport-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 13KB
          • SHA256 f205e9c1ad5f029555d56a24fb7a3309a6ddd554eb19989fc3a1d309c990a6bd
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-string-l1-1-0.dll
          • Size 13KB
          • SHA256 e7f1d2398de4a7242b79a21f85d3ab9bdaac3e70e50ef1eac5da1cba09dda192
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-synch-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-synch-l1-1-0.dll
          • Size 15KB
          • SHA256 da79a38d4799a9e4f3aaaaeea05a2f47d323d3472f5361478e20e5075b63af9e
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-synch-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-synch-l1-2-0.dll
          • Size 13KB
          • SHA256 8ec827f3a991a313137d3c378bddc7022640c0b1ba79ebcd847ed3ecedc425b3
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-sysinfo-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 14KB
          • SHA256 71ba7dd22ffa833b924778c5d0421819cf01625b4d7462c463c2cf75cf596806
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-timezone-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-timezone-l1-1-0.dll
          • Size 13KB
          • SHA256 a6cbce99976a8fdd8d9cc278c7d8aebbc4a6ae6404684021d73c8f4e520b98dc
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-core-util-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-core-util-l1-1-0.dll
          • Size 13KB
          • SHA256 96d0b3666651b0ad01fd7877ea19f35c78fd3b87e0da0007889212022edbba8d
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-conio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-conio-l1-1-0.dll
          • Size 14KB
          • SHA256 a0c144a76b80909a25b202114c07a06927f33ec237131d27c409cb4411bd6f1b
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-convert-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-convert-l1-1-0.dll
          • Size 17KB
          • SHA256 a3330afde4c96d0bfd58a328d32cec7f47013a737a33fe074678ef5537e9f34e
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-environment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-environment-l1-1-0.dll
          • Size 13KB
          • SHA256 a6522d4ec322ba2d55704e5990d465620ab33dbcbf2716bbb1a5c0a997a4c800
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-filesystem-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 15KB
          • SHA256 1817be3001c47078676cc8e43e472efc95bc8a56f73dbcdb303036f6758be398
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-heap-l1-1-0.dll
          • Size 14KB
          • SHA256 5847f24760d9b392264e02b00933e4e8cbed704238f24075ccdd0e2bef3fd86a
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-locale-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-locale-l1-1-0.dll
          • Size 13KB
          • SHA256 556af10c9c9cee5ce7dab89a66693f41b50051bb39abb8365374829004cfe20e
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-math-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-math-l1-1-0.dll
          • Size 22KB
          • SHA256 fd7c108c8b26ef8bbb3eee7dbadfa6031dfb6c2c0c1a74953034e0d080219646
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-process-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-process-l1-1-0.dll
          • Size 14KB
          • SHA256 369422b6ba609abad09208c9618a57030a0b5e77d6e7b171b6f2cb6c32567103
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-runtime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 17KB
          • SHA256 973e8a72432bd3169aec3967ce18146938608a335329a9b2d764b43aeeddddbb
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-stdio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 19KB
          • SHA256 c4fe765c675f30acf8b22040ba77ac0f06d1c334489f0e5da4f98f648a73f0f1
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-string-l1-1-0.dll
          • Size 19KB
          • SHA256 91fb2c073fcd138b41c34e90b7fee8b852a1371da638aa5e34a365c2fe9e6c9f
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-time-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-time-l1-1-0.dll
          • Size 15KB
          • SHA256 88e5cb9f5e3981e0792991583d2c5b4309787498f5a4a317d8bf3ef3658e9710
          • MD5 SHA1 SHA512 SSDEEP

          api-ms-win-crt-utility-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\api-ms-win-crt-utility-l1-1-0.dll
          • Size 13KB
          • SHA256 9ebe8f7e48f9989c878bed62126859677027b8f5f6cd7089c8bc846bdc8f79f9
          • MD5 SHA1 SHA512 SSDEEP

          base_library.zip

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\base_library.zip
          • Size 824KB
          • SHA256 25b9e038ab3ccaafba554e90d5b6198a34e064d5c332a89ffc960fba278deb8a
          • MD5 SHA1 SHA512 SSDEEP

          libcrypto-1_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\libcrypto-1_1.dll
          • Size 3.2MB
          • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
          • MD5 SHA1 SHA512 SSDEEP

          libssl-1_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\libssl-1_1.dll
          • Size 674KB
          • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
          • MD5 SHA1 SHA512 SSDEEP

          pyexpat.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\pyexpat.pyd
          • Size 187KB
          • SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
          • MD5 SHA1 SHA512 SSDEEP

          python38.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\python38.dll
          • Size 4.0MB
          • SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
          • MD5 SHA1 SHA512 SSDEEP

          select.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\select.pyd
          • Size 27KB
          • SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
          • MD5 SHA1 SHA512 SSDEEP

          ucrtbase.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\ucrtbase.dll
          • Size 987KB
          • SHA256 c446df8432ff2679961763de876432fcf13f272269c17417e7eccbda0b000448
          • MD5 SHA1 SHA512 SSDEEP

          unicodedata.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI16922\unicodedata.pyd
          • Size 1.0MB
          • SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
          • MD5 SHA1 SHA512 SSDEEP

          _bz2.pyd

          • Path \Users\Admin\AppData\Local\Temp\_MEI16922\_bz2.pyd
          • Size 85KB
          • SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
          • MD5 SHA1 SHA512 SSDEEP

          _lzma.pyd

          • Path \Users\Admin\AppData\Local\Temp\_MEI16922\_lzma.pyd
          • Size 159KB
          • SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
          • MD5 SHA1 SHA512 SSDEEP

          libffi-7.dll

          • Path \Users\Admin\AppData\Local\Temp\_MEI16922\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP