c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee

Analysis

max time kernel
15s
max time network
19s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10/06/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sigthief.exe
Size 6.4MB
Sample240610-hf1nesea77
SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
MD5 3e261becbfe12d7a5ffdbba91c76011b
SHA1 2e5849aa0be921849f42121544895ce405fd9af1
SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
212	sigthief.exe
212	sigthief.exe
212	sigthief.exe
212	sigthief.exe
212	sigthief.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 212	4764	sigthief.exe	74
PID 4764 wrote to memory of 212	4764	sigthief.exe	74

C:\Users\Admin\AppData\Local\Temp\sigthief.exe
"C:\Users\Admin\AppData\Local\Temp\sigthief.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\sigthief.exe
  "C:\Users\Admin\AppData\Local\Temp\sigthief.exe"
  2⤵
  - Loads dropped DLL
  PID:212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47642\base_library.zip
Size 1.0MB
SHA256 a11b40a99cc08c769c2bfb97c4996d3fe1052a204cbb9e3b4994c3fc4d32d341
MD5 d5391ee8538a06d6622f31d3ec907407
SHA1 f322e086573ecf325f422fd0fdab032e2a8c22a0
SHA512 c0b46b54e4f358d9fceb65d471c755f77817a5ef5f6e87ff33c8d2eef1157d0ded4143d07aa72b92e1a40d6b7b025eb314695c80c85d67a383c14a7495b654a6
SSDEEP 12288:oEHYKmhcWyBC6SOIE/8A4a2Y4jdOVwx/fpEWerzku+E0SLMNU:oEHYYVBcLa21oVwx/fpEWe8u+E/MNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47642\python310.dll
Size 4.3MB
SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
MD5 54f8267c6c116d7240f8e8cd3b241cd9
SHA1 907b965b6ce502dad59cde70e486eb28c5517b42
SHA512 f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
SSDEEP 49152:+xWM30WEuKdhbvd9aCLYjiNME9KnPdZkAMnu08M2c3MrOEJ8wwoJCzSy4I0mUHJq:+eV7bkwMVPZRHqzt0XHaMZqSH1jze
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47642\ucrtbase.dll
Size 993KB
SHA256 962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36
MD5 9679f79d724bcdbd3338824ffe8b00c7
SHA1 5ded91cc6e3346f689d079594cf3a9bf1200bd61
SHA512 74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd
SSDEEP 24576:ZLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+o:dyubJvlhrVETiR+o
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path \Users\Admin\AppData\Local\Temp\_MEI47642\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI47642\_bz2.pyd
Size 81KB
SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
MD5 23dce6cd4be213f8374bf52e67a15c91
SHA1 dfc1139d702475904326cb60699fec09de645009
SHA512 c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
SSDEEP 1536:LsRz7qldca26V6bw3haLRFcja8Ed7jjWHCFI4tV87SyzPxA:YRzGgohaQ9Ed7jjWiFI4tV81xA
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI47642\_lzma.pyd
Size 154KB
SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
MD5 401eca12e2beb9c2fbf4a0d871c1c500
SHA1 7cfc2f94ade6712dd993186041e54917a3dd15ae
SHA512 da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
SSDEEP 3072:sc+sMZ4drcsAF5FRm1YznfI9mNoxapHVZKeFI4e1QGxK:r+sMAIt5dwYOxatKeV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads