Overview

overview

7

Static

static

3

playSong.exe

windows10-1703-x64

7

playSong.exe

windows10-2004-x64

7

playSong.exe

windows11-21h2-x64

7

playSong.pyc

windows10-1703-x64

3

playSong.pyc

windows10-2004-x64

3

playSong.pyc

windows11-21h2-x64

3

Analysis

  • max time kernel
    1s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/06/2024, 23:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    playSong.exe
  • Size 9.9MB
  • Sample240610-27hfpsvemn
  • SHA256 aa14dad18e2115ec46526aa1d9894803ec563c208f035ce68579a2a2bd4b9dad
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\playSong.exe
    "C:\Users\Admin\AppData\Local\Temp\playSong.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Users\Admin\AppData\Local\Temp\playSong.exe
      "C:\Users\Admin\AppData\Local\Temp\playSong.exe"
      2⤵
      • Loads dropped DLL
      PID:2140

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_ctypes.pyd
        • Size 123KB
        • SHA256 2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_queue.pyd
        • Size 27KB
        • SHA256 dd8c39ff48de02f3f74256a61bf3d9d7e411c051dd4205ca51446b909458f0cd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_socket.pyd
        • Size 77KB
        • SHA256 1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\base_library.zip
        • Size 768KB
        • SHA256 ae8f1046d28fc1d62b4c1dc2c6c55535eba2473abf7e61a33ae7307181c03f06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        playSong.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\playSong.exe.manifest
        • Size 1KB
        • SHA256 9576a1972532cddc379e9f042582655519aaad764e82190308b8f504ea86e06c
        • MD5 SHA1 SHA512
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\python38.dll
        • Size 4.0MB
        • SHA256 13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\select.pyd
        • Size 26KB
        • SHA256 940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\ucrtbase.dll
        • Size 971KB
        • SHA256 ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download