Overview

overview

7

Static

static

3

playSong.exe

windows10-1703-x64

7

playSong.exe

windows10-2004-x64

7

playSong.exe

windows11-21h2-x64

7

playSong.pyc

windows10-1703-x64

3

playSong.pyc

windows10-2004-x64

3

playSong.pyc

windows11-21h2-x64

3

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 23:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    playSong.exe
  • Size 9.9MB
  • Sample240610-27hfpsvemn
  • SHA256 aa14dad18e2115ec46526aa1d9894803ec563c208f035ce68579a2a2bd4b9dad
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\playSong.exe
    "C:\Users\Admin\AppData\Local\Temp\playSong.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Users\Admin\AppData\Local\Temp\playSong.exe
      "C:\Users\Admin\AppData\Local\Temp\playSong.exe"
      2⤵
      • Loads dropped DLL
      PID:3968
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
    1⤵
      PID:5208

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\VCRUNTIME140.dll
          • Size 99KB
          • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_ctypes.pyd
          • Size 123KB
          • SHA256 2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_queue.pyd
          • Size 27KB
          • SHA256 dd8c39ff48de02f3f74256a61bf3d9d7e411c051dd4205ca51446b909458f0cd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\_socket.pyd
          • Size 77KB
          • SHA256 1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\base_library.zip
          • Size 768KB
          • SHA256 ae8f1046d28fc1d62b4c1dc2c6c55535eba2473abf7e61a33ae7307181c03f06
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          playSong.exe.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\playSong.exe.manifest
          • Size 1KB
          • SHA256 9576a1972532cddc379e9f042582655519aaad764e82190308b8f504ea86e06c
          • MD5 SHA1 SHA512
          Submit Download

          python38.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\python38.dll
          • Size 4.0MB
          • SHA256 13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\select.pyd
          • Size 26KB
          • SHA256 940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI42882\ucrtbase.dll
          • Size 971KB
          • SHA256 ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download