Overview

overview

7

Static

static

3

Versatools.exe

windows7-x64

7

Versatools.exe

windows10-2004-x64

7

Resubmissions

16/06/2024, 10:20

240616-mddhbszckh7

16/06/2024, 10:16

240616-mas4lstbml7

Analysis

  • max time kernel
    141s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 10:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Versatools.exe
  • Size 37.8MB
  • Sample240616-mas4lstbml
  • SHA256 b3ce37ea3d136782dc85e8b6cec7842969eaa9564ecc409676271e27a812f551
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Versatools.exe
    "C:\Users\Admin\AppData\Local\Temp\Versatools.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\Versatools.exe
      "C:\Users\Admin\AppData\Local\Temp\Versatools.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:1704
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:2828

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _imaging.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\PIL\_imaging.cp311-win_amd64.pyd
            • Size 2.3MB
            • SHA256 f82bd3cf95e02749ff1adff76725e3645e17c2780954bd724ed63ef6827633f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\VCRUNTIME140.dll
            • Size 106KB
            • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_asyncio.pyd
            • Size 63KB
            • SHA256 0237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_bz2.pyd
            • Size 82KB
            • SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_ctypes.pyd
            • Size 120KB
            • SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_decimal.pyd
            • Size 247KB
            • SHA256 93eb9d1859edca1c29594491863bf3d72af70b9a4240e0d9dd171f668f4f8614
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_hashlib.pyd
            • Size 63KB
            • SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_lzma.pyd
            • Size 155KB
            • SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_overlapped.pyd
            • Size 49KB
            • SHA256 d950342686c959056ff43c9e5127554760fa20669d97166927dd6aae5494e02a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_queue.pyd
            • Size 31KB
            • SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_socket.pyd
            • Size 77KB
            • SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_ssl.pyd
            • Size 157KB
            • SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\_uuid.pyd
            • Size 24KB
            • SHA256 f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\base_library.zip
            • Size 1.8MB
            • SHA256 ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\certifi\cacert.pem
            • Size 283KB
            • SHA256 cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\libssl-1_1.dll
            • Size 688KB
            • SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\psutil\_psutil_windows.pyd
            • Size 65KB
            • SHA256 43e09408673687a787415912336ac13fcca9a7d7945b73d0c84ac4bb071e9106
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\pyexpat.pyd
            • Size 194KB
            • SHA256 2ff8cd82e7cc255e219e7734498d2dea0c65a5ab29dc8581240d40eb81246045
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\python3.DLL
            • Size 65KB
            • SHA256 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\python311.dll
            • Size 5.5MB
            • SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            pythoncom311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\pywin32_system32\pythoncom311.dll
            • Size 654KB
            • SHA256 0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            pywintypes311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\pywin32_system32\pywintypes311.dll
            • Size 131KB
            • SHA256 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\select.pyd
            • Size 29KB
            • SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _speedups.cp311-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\simplejson\_speedups.cp311-win_amd64.pyd
            • Size 39KB
            • SHA256 bc15b60da221f8656cdb201198ab7fa2575ad8d41c357b67b8678f9bbf3961af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tls-client-64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\tls_client\dependencies\tls-client-64.dll
            • Size 15.7MB
            • SHA256 ec4f40c5f1ac709313b027c16face4d83e0dafdbc466cff2ff5d029d00600a20
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\ucrtbase.dll
            • Size 987KB
            • SHA256 a2ab58e44828009f6dafe54dd5ed57edfa6b09641e3c8eaa473b37e5b0e2b862
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\unicodedata.pyd
            • Size 1.1MB
            • SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            win32api.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\win32\win32api.pyd
            • Size 130KB
            • SHA256 fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            win32event.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI39362\win32\win32event.pyd
            • Size 28KB
            • SHA256 e800152568bb46f4a0a3417eb749ef45f2e5cc0b33fb9dea55e1a1cd012b54c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Local\Temp\files\config.json
            • Size 5KB
            • SHA256 d9241e48094f28b176a4400a9729b5f3c611611e8d07c68598d324f59cf3fb44
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/3688-193-0x00007FFD40D60000-0x00007FFD41CEC000-memory.dmp
            Download