d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
Size 6.8MB
Sample240612-nya4datcqb
SHA256 d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586
MD5 0f65c324f2422507a62b2ca40388816d
SHA1 dd1a84c214fa0e6069ea0c16f6173eda3672b7d2
SHA512 22d9cfca9486bb2a2c79d909d931474551a365e6c101a34956f7f33b98c3abdc9257a57fafb66a927f370ec6a26370bee7c57c2878771265319571f83e507f76
SSDEEP 196608:buqn9onJ5hrZEK3e9tGPqKZdI+Tb84wKu7SsSO:1n9c5hlEK/PNZdI+3EN7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 17 IoCs

pid	Process
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	1152	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 1152	184	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe	82
PID 184 wrote to memory of 1152	184	d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe	82

C:\Users\Admin\AppData\Local\Temp\d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
"C:\Users\Admin\AppData\Local\Temp\d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:184
- C:\Users\Admin\AppData\Local\Temp\d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe
  "C:\Users\Admin\AppData\Local\Temp\d94bdf4f51d0f3ef2fe46a8d776d8c6273bd4696dd520e79cdedab45590a9586.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\VCRUNTIME140.dll
Size 85KB
SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
MD5 89a24c66e7a522f1e0016b1d0b4316dc
SHA1 5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42
SHA512 e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a
SSDEEP 1536:JiOTTyNdd/mqN5fomseOpLJ5UP4nVnWecbtGgcNZVKL:JD4Vzgh5UXecbt2ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_bz2.pyd
Size 92KB
SHA256 8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
MD5 cf77513525fc652bad6c7f85e192e94b
SHA1 23ec3bb9cdc356500ec192cac16906864d5e9a81
SHA512 dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9
SSDEEP 1536:DGb6DBCvurMRnQhVx8/Nlv+SSm9YmFN87Xgq4ToV+dypRI84VAyE:abfXyg7pp9TC7Xgq4ToV+kRI84VY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_ctypes.pyd
Size 129KB
SHA256 430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
MD5 5e869eebb6169ce66225eb6725d5be4a
SHA1 747887da0d7ab152e1d54608c430e78192d5a788
SHA512 feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16
SSDEEP 1536:bRyGuR/8oD9tR2yHBIjxBaVGTODsAR04D0RfUGpd0/b8aMgiadI8VPEye:bcDd8oM+kBVQ/8f5pdObL7dI8VPG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_hashlib.pyd
Size 38KB
SHA256 ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
MD5 b32cb9615a9bada55e8f20dcea2fbf48
SHA1 a9c6e2d44b07b31c898a6d83b7093bf90915062d
SHA512 5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe
SSDEEP 768:AyvaHXGH0o9MBl7nqHQ03dpI8sIZhWDG4yfkO:UKnyBlmHQadpI8sIZcyMO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_lzma.pyd
Size 172KB
SHA256 f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
MD5 5fbb728a3b3abbdd830033586183a206
SHA1 066fde2fa80485c4f22e0552a4d433584d672a54
SHA512 31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb
SSDEEP 3072:KCvUDHEIzx6yBexOV3fNDjGTtDlQxueKd03DV8tv9XIGIPExZJV9mNoA2v1kqnfE:tvUtdBexOlNDk+xTKg8tlJKyXYOAC1Lc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_queue.pyd
Size 27KB
SHA256 e499824d58570c3130ba8ef1ac2d503e71f916c634b2708cc22e95c223f83d0a
MD5 c0a70188685e44e73576e3cd63fc1f68
SHA1 36f88ca5c1dda929b932d656368515e851aeb175
SHA512 b9168bf1b98da4a9dfd7b1b040e1214fd69e8dfc2019774890291703ab48075c791cc27af5d735220bd25c47643f098820563dc537748471765aff164b00a4aa
SSDEEP 384:lDZ54qTq9Qe//7vWXhTR/cEI6rgdI8qU8nYPLxDG4y8HmsuEyo:p4qwQ0WRtS6rgdI8qU8WDG4y6XuEyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_socket.pyd
Size 75KB
SHA256 9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
MD5 8ea18d0eeae9044c278d2ea7a1dbae36
SHA1 de210842da8cb1cb14318789575d65117d14e728
SHA512 d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0
SSDEEP 1536:vG/A9Fu5OEPenRXk5d2jw/hEdFcvY+RgOmkcH7dI8VwYyo:e/Anu5OEPenRXRjw/h0FcvYcgOmkcbdV
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\_ssl.pyd
Size 118KB
SHA256 b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047
MD5 5a393bb4f3ae499541356e57a766eb6a
SHA1 908f68f4ea1a754fd31edb662332cf0df238cf9a
SHA512 958584fd4efaa5dd301cbcecbfc8927f9d2caec9e2826b2af9257c5eefb4b0b81dbbadbd3c1d867f56705c854284666f98d428dc2377ccc49f8e1f9bbbed158f
SSDEEP 3072:B9+/8UxGzqHYjeS0Woia4TMpi6EPQNvURI847uHV:b+UUxGiY8Wo1UVV
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\base_library.zip
Size 777KB
SHA256 a50f524eed66843246d6fdb765fb5a96c33b4aa4aab2efda7c11592c2ef80606
MD5 ca531de5744f22c704de726bd3353404
SHA1 bc19aa77ad9bbac86bae3a7209bca5fc2d602ed3
SHA512 42e19ee714e2d7de0ed29645d21c50946abd90cec29d04bf1a6a7fba26cbe664b1c3bae55fa011b58d7ea33736e2a1667615abc93ad89f976591d8ccfcf4ff2c
SSDEEP 24576:iGHc9TosQNRs54PK4IOUVi+Zsf6ER22VLQ:iGHc9TosQNRs54PK4IRZP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\certifi\cacert.pem
Size 259KB
SHA256 fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c
MD5 ea4ee2af66c4c57b8a275867e9dc07cd
SHA1 d904976736e6db3c69c304e96172234078242331
SHA512 4114105f63e72b54e506d06168b102a9130263576200fb21532140c0e9936149259879ac30a8b78f15ae7cb0b59b043db5154091312da731ac16e67e6314c412
SSDEEP 6144:fW1H7M8f9Z0mNplX4XCRrcMFADwYCuMsligT/Q5MS/:fWN7vZLNLqCRrctb65Mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\libcrypto-1_1.dll
Size 3.2MB
SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
MD5 cc4cbf715966cdcad95a1e6c95592b3d
SHA1 d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA512 3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
SSDEEP 98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\libssl-1_1.dll
Size 673KB
SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
MD5 bc778f33480148efa5d62b2ec85aaa7d
SHA1 b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA512 80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
SSDEEP 12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

python37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\python37.dll
Size 3.6MB
SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
MD5 c4709f84e6cf6e082b80c80b87abe551
SHA1 c0c55b229722f7f2010d34e26857df640182f796
SHA512 e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4
SSDEEP 49152:KjVpkcACTIK0IKhyn9iafAdH1ZRHLqUCbNSuvYVeP84mzIAA5H0LMznZPMXT7p31:3CTIdKI7UWu4cAgHCMzqNOyVB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pywintypes37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\pywintypes37.dll
Size 137KB
SHA256 6b812a4859567ddf5f6d8a37a66fad120c040f6cbdd374969e78a94f1906ccbb
MD5 860c13c5a5eae842f87685370c8ddac6
SHA1 d51266f73acaf1ada0571c70e1ef2c0224191193
SHA512 c3279b70bf191c3c3e45ca232e6a3dd8a24f53bdaf9839de1ef9fa0097d883f74faa1ea9a6c1d1e5bfeee40c4aa61985ece1f603f6da1cea0c5bb0e43610e291
SSDEEP 3072:xo4Bkam7M2ErYrrC0bj/agTekc7Z+Swv4umOIe03:OrasM2sYrrC0npJcUSU4Wc
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\select.pyd
Size 26KB
SHA256 65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
MD5 fb4a0d7abaeaa76676846ad0f08fefa5
SHA1 755fd998215511506edd2c5c52807b46ca9393b2
SHA512 f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f
SSDEEP 384:FekE2XR1G6sOhmQI2HTRcqJcE99qT3dI8qGvnYPLxDG4y8Z6K9:F9csXHN/d9qT3dI8qGvWDG4yM
MD5 SHA1 SHA512 SSDEEP

Submit Download

tinyaes.cp37-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\tinyaes.cp37-win_amd64.pyd
Size 39KB
SHA256 851eeae819a8935d0e32606d7e61cc0e5300ab161f1bfec0feb6aa96fd27223f
MD5 9c22279bcf5c003fd9828703b7f433dc
SHA1 0acf5acc37afaa9159ed71e943d9815e20416afa
SHA512 a8358336a40f06d378c83bfedc86c80d3e21f5d621275da821c25a72dcde56e05ae41364f7945cd73adc27a776812f2128a1e7ca0a0c616edc4db3e02625cd2b
SSDEEP 768:eK+JYkuuLgnQhTaMRkjlF3RGZznYYwdDw+E6qcfnugkUW:GZuugOohNIkYEDwifu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\ucrtbase.dll
Size 993KB
SHA256 32a26110ad1e4af211e8f3df9a608ab13ccc69861c6e06817ca1d4ab164209aa
MD5 8732fc270e688c3b3aac407df7c85f67
SHA1 96fcf61589a1475aba24f1b07e579421b7f178e0
SHA512 812581cc925bb7f68773bb7c55a15c5a6d2122bc362c91ed0176c9fc9c2a64877fbee0a7416a5b512a4707575cb2dd66842531018c16321df7359d8e5817ba75
SSDEEP 24576:hLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+D:VyubJvlhrVETiR+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\unicodedata.pyd
Size 1.0MB
SHA256 016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095
MD5 4d3d8e16e98558ff9dac8fc7061e2759
SHA1 c918ab67b580f955b6361f9900930da38cec7c91
SHA512 0dfabfad969da806bc9c6c664cdf31647d89951832ff7e4e5eeed81f1de9263ed71bddeff76ebb8e47d6248ad4f832cb8ad456f11e401c3481674bd60283991a
SSDEEP 12288:ge+YbeoEYa6l0SYxytHcQJJwEI+V/IFx7agsSJNzkRoEVnOPmrZ6bK:ge+BN6axoc1r+VUx7agnNctOo6K
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI1842\win32api.pyd
Size 131KB
SHA256 0243f0f6b9f4a5e94408d03a9aab90ea0c3c9a34e2f36d69c69a2ce4215521b3
MD5 042683d998900b253d9a4201f2485068
SHA1 d2ffb995999b0d7df06a64a7fe8b9b72d381e935
SHA512 6417e4503bb6d6fbb28e390af096a99bc21c708c442a3813c565716ab2984ff19b12da0e8eff533c0ca06bcbda6c3847deeb2356dede76f750423f1af0331e7c
SSDEEP 3072:IEbA11dsVC7lL1r2HBshsvZS1VuqQuQrRuTnr6We:X8LCVClsvZS1Vutu9rr6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads