Overview

overview

7

Static

static

3

218aafbacf...aa.exe

windows7-x64

7

218aafbacf...aa.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa.exe
  • Size 9.4MB
  • Sample240612-ntlpbatbke
  • SHA256 218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa.exe
    "C:\Users\Admin\AppData\Local\Temp\218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Users\Admin\AppData\Local\Temp\218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa.exe
      "C:\Users\Admin\AppData\Local\Temp\218aafbacf5d13fc7d7d6d496d982be6940fa75e18c4bff1c0bca7aead641daa.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 688
        3⤵
        • Program crash
        PID:4468
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3328 -ip 3328
    1⤵
      PID:1460

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\VCRUNTIME140.dll
          • Size 81KB
          • SHA256 9d8d21022ff9d3f6b81a45209662a4f3481edc2befae0c73b83cf942eab8be25
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _cffi_backend.cp37-win32.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\_cffi_backend.cp37-win32.pyd
          • Size 152KB
          • SHA256 33a5ab6c627527887b82058c4dbfbfd5d88bbf187302e73aa3169b81e12cba40
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\_hashlib.pyd
          • Size 24KB
          • SHA256 661aa7ab2cd173b112fef560a3bf63a87c906c8b184cb261632c5a32c6c25185
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\_queue.pyd
          • Size 16KB
          • SHA256 9774e28ffca8b222f32afca5a34bfefb01e53188630be7cffcf615b3a068b0c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\_socket.pyd
          • Size 57KB
          • SHA256 2ba14eda8ac2189ee7c0b136f653030c5078deaf3a792ee47e9b9a4b859a0675
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\_sqlite3.pyd
          • Size 60KB
          • SHA256 c219f1422e72e14e821fe15acea9593cfa05dfe20ba177085784d858df3895ef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\base_library.zip
          • Size 760KB
          • SHA256 f3a57a4a006a3e6b9b335d1593f39f9dacdb61fc46d0c5e416dd10bf41e6c663
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _openssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\cryptography\hazmat\bindings\_openssl.pyd
          • Size 2.8MB
          • SHA256 5c9ca3556e7fb2cfd85e8994c6aa19ccbdb57247d39183c542beade9658dff1d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _rust.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\cryptography\hazmat\bindings\_rust.pyd
          • Size 1.3MB
          • SHA256 85d4d4359fe3a74b04d9c6faebe95a37a9327a5101b0d8b2a394b23362914c6a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\libcrypto-1_1.dll
          • Size 2.4MB
          • SHA256 0054ced974ae447c3d6e9ca312feb8a0a5dcca81dd92e940d3d8276add3e2f00
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\python3.dll
          • Size 50KB
          • SHA256 b51c88ac791ed574edfb2e346095fbc296a2c36250c2bffdd28bb424d8135ae7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python37.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\python37.dll
          • Size 2.9MB
          • SHA256 5a2547ffc53680bca395e61714e36f35f25ddd7099e1e7ee0bda04865e9012b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pywintypes37.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\pywintypes37.dll
          • Size 115KB
          • SHA256 15744c8a510b30c7574d4a687ab42e934b9dbc43ba64fa0ed0d6b4e4a68dc81d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\select.pyd
          • Size 16KB
          • SHA256 f94e54d25ba8c9c41ee2496a1887df215b7ca5b4f8ee47aa7db98168a2498b60
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\sqlite3.dll
          • Size 1.1MB
          • SHA256 d2e2270be83e25a1895407cf087b5dbfdf1c82478dc19d7e4e6ac00060a2e121
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\ucrtbase.dll
          • Size 1.1MB
          • SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI40602\win32crypt.pyd
          • Size 105KB
          • SHA256 b4acd9df9ee1ad1df6ea247695bf980d3d60e2ce4a8b163101f4dfb2530eb097
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download