Analysis

  • max time kernel
    93s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 11:13

General

  • Target
    StarOptimizer1.2.exe
  • Size 13.9MB
  • Sample240616-nbp9savekr
  • SHA256 f34d1e06fe517a516581cf1569849cb4b4c98e156ed9a82c200e671dfb960a63
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 15 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\StarOptimizer1.2.exe
    "C:\Users\Admin\AppData\Local\Temp\StarOptimizer1.2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\StarOptimizer1.2.exe
      "C:\Users\Admin\AppData\Local\Temp\StarOptimizer1.2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "pip install colorama"
        3⤵
          PID:4216
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "pip install psutil"
          3⤵
            PID:3036

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\VCRUNTIME140.dll
            • Size 95KB
            • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
            • MD5 SHA1 SHA512 SSDEEP

            VCRUNTIME140_1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\VCRUNTIME140_1.dll
            • Size 36KB
            • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
            • MD5 SHA1 SHA512 SSDEEP

            _bz2.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_bz2.pyd
            • Size 85KB
            • SHA256 c0dd9496b19ba9536a78a43a97704e7d4bef3c901d196ed385e771366682819d
            • MD5 SHA1 SHA512 SSDEEP

            _ctypes.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_ctypes.pyd
            • Size 125KB
            • SHA256 a8703f949c9520b76cb1875d1176a23a2b3ef1d652d6dfac6e1de46dc08b2aa3
            • MD5 SHA1 SHA512 SSDEEP

            _decimal.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_decimal.pyd
            • Size 265KB
            • SHA256 c6eb532da62a115ae75f58766b632e005140a2e7c9c67a77564f1804685a377f
            • MD5 SHA1 SHA512 SSDEEP

            _hashlib.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_hashlib.pyd
            • Size 64KB
            • SHA256 c5b8c4582e201fef2d8cb2c8672d07b86dec31afb4a17b758dbfb2cff163b12f
            • MD5 SHA1 SHA512 SSDEEP

            _lzma.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_lzma.pyd
            • Size 160KB
            • SHA256 6e571d93ce55d09583ec91c607883a43c1da3d4d36794d68c6ecd6bea4ab466a
            • MD5 SHA1 SHA512 SSDEEP

            _queue.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_queue.pyd
            • Size 30KB
            • SHA256 2782cf3c04801ede65011be282e99cd34d163b2b2b2333fd3147b33f7d5e72ab
            • MD5 SHA1 SHA512 SSDEEP

            _socket.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_socket.pyd
            • Size 79KB
            • SHA256 9e97b782b55400e5a914171817714bbbc713c0a396e30496c645fc82835e4b34
            • MD5 SHA1 SHA512 SSDEEP

            _ssl.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_ssl.pyd
            • Size 153KB
            • SHA256 d318795c98c5f3c127c8e47220a92acba0736daf31bab0dc9c7e6c3513bb2aa3
            • MD5 SHA1 SHA512 SSDEEP

            _tkinter.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_tkinter.pyd
            • Size 65KB
            • SHA256 313fb33e72028fcc893ec7874e0c825c035cdcebe1b5b7c7d8d11ef3ad1b354f
            • MD5 SHA1 SHA512 SSDEEP

            _uuid.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\_uuid.pyd
            • Size 24KB
            • SHA256 c4ce019fbd541918d3e7ddf7845bf0449068fc7eee3b57da730860fc7741d561
            • MD5 SHA1 SHA512 SSDEEP

            base_library.zip

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\base_library.zip
            • Size 829KB
            • SHA256 1d65a1aa5567fed89c66fd813a5136b47e706e8d7f95d7d8eef656013ddd23a4
            • MD5 SHA1 SHA512 SSDEEP

            libcrypto-1_1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
            • MD5 SHA1 SHA512 SSDEEP

            libffi-7.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP

            libssl-1_1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\libssl-1_1.dll
            • Size 682KB
            • SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
            • MD5 SHA1 SHA512 SSDEEP

            pyexpat.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\pyexpat.pyd
            • Size 201KB
            • SHA256 f32af8a21c016702647a83661eb4460bac7c791754cb1faaf1c4d096a94cd7cb
            • MD5 SHA1 SHA512 SSDEEP

            python39.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\python39.dll
            • Size 4.3MB
            • SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
            • MD5 SHA1 SHA512 SSDEEP

            pythoncom39.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\pywin32_system32\pythoncom39.dll
            • Size 654KB
            • SHA256 0789f9321abfa3a6403a483cb3ba684da5cfc39d26195fce8669a77c6367c413
            • MD5 SHA1 SHA512 SSDEEP

            pywintypes39.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\pywin32_system32\pywintypes39.dll
            • Size 131KB
            • SHA256 20bde8e50e42f7aabf59106eea238fcc0dece0c6e362c0a7feeb004ab981db8a
            • MD5 SHA1 SHA512 SSDEEP

            select.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\select.pyd
            • Size 29KB
            • SHA256 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3
            • MD5 SHA1 SHA512 SSDEEP

            tcl86t.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\tcl86t.dll
            • Size 1.8MB
            • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
            • MD5 SHA1 SHA512 SSDEEP

            tk86t.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\tk86t.dll
            • Size 1.5MB
            • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
            • MD5 SHA1 SHA512 SSDEEP

            unicodedata.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\unicodedata.pyd
            • Size 1.1MB
            • SHA256 3a0987025f1cf2111dc6e4f59402073ba123d7436d809ee4198b4e7bfb8cb868
            • MD5 SHA1 SHA512 SSDEEP

            win32api.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI21242\win32\win32api.pyd
            • Size 130KB
            • SHA256 a52f8bd28b5b9558cde10333ce452a7d6f338ce1005a2b8451755005868e4a98
            • MD5 SHA1 SHA512 SSDEEP