Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 21:48

General

  • Target

    49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe

  • Size

    6.4MB

  • MD5

    b31862b37b92e5b8cad73dd8e24a6acd

  • SHA1

    0175211a6e5b372a673b218d65930574ef21e80d

  • SHA256

    49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076

  • SHA512

    cff358fd8591d3d2bbc908188465ea8d6ccdec05a18eae9147f259dc9af825741a8f7f743fe9d0d889a52014b8463bfc9c28adc772480bbfe7c246324af6a1ab

  • SSDEEP

    196608:RQMuWJysVYvsO+oyMxxvjDDAx5SE8EsVHt72m:CWJtoyMxtDDAxQFt

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe
    "C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe
      "C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"
      2⤵
      • Loads dropped DLL
      PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_bz2.pyd

    Filesize

    82KB

    MD5

    3dc8af67e6ee06af9eec52fe985a7633

    SHA1

    1451b8c598348a0c0e50afc0ec91513c46fe3af6

    SHA256

    c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

    SHA512

    da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_hashlib.pyd

    Filesize

    44KB

    MD5

    a6448bc5e5da21a222de164823add45c

    SHA1

    6c26eb949d7eb97d19e42559b2e3713d7629f2f9

    SHA256

    3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

    SHA512

    a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_lzma.pyd

    Filesize

    246KB

    MD5

    37057c92f50391d0751f2c1d7ad25b02

    SHA1

    a43c6835b11621663fa251da421be58d143d2afb

    SHA256

    9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

    SHA512

    953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_queue.pyd

    Filesize

    27KB

    MD5

    44b72e0ad8d1e1ec3d8722088b48c3c5

    SHA1

    e0f41bf85978dd8f5abb0112c26322b72c0d7770

    SHA256

    4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

    SHA512

    05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_socket.pyd

    Filesize

    77KB

    MD5

    d6bae4b430f349ab42553dc738699f0e

    SHA1

    7e5efc958e189c117eccef39ec16ebf00e7645a9

    SHA256

    587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

    SHA512

    a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ssl.pyd

    Filesize

    115KB

    MD5

    8ee827f2fe931163f078acdc97107b64

    SHA1

    149bb536f3492bc59bd7071a3da7d1f974860641

    SHA256

    eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

    SHA512

    a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\base_library.zip

    Filesize

    1003KB

    MD5

    4b0f4f93f77753fcc507899ec698d3c2

    SHA1

    3db59eecafab5f9e0f9eaf6084eb38470a3f5c80

    SHA256

    41321aae8a8ef02cb511bfceff167b5a255120c8998b8241e6738c35fce3bddd

    SHA512

    33d9e349d38896c53bfef2ea5103a6ab764ea8069602f7509576668a630607d22ee13516707754cdd8763a1eaf5229dc8b2e4f26527b75023e12f6d2d89cc17d

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\certifi\cacert.pem

    Filesize

    287KB

    MD5

    2a6bef11d1f4672f86d3321b38f81220

    SHA1

    b4146c66e7e24312882d33b16b2ee140cb764b0e

    SHA256

    1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c

    SHA512

    500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md.cp38-win_amd64.pyd

    Filesize

    10KB

    MD5

    38105df780eddd734027328e0dca0ca3

    SHA1

    45f1d9e3472478f8e1ba86675f5c81c00b183bea

    SHA256

    9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

    SHA512

    ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

    Filesize

    116KB

    MD5

    073f09e1edf5ec4173ce2de1121b9dd1

    SHA1

    6cdb2559a1b706446cdd993e6fd680095e119b2e

    SHA256

    7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

    SHA512

    70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    bf83f8ad60cb9db462ce62c73208a30d

    SHA1

    f1bc7dbc1e5b00426a51878719196d78981674c4

    SHA256

    012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

    SHA512

    ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\libssl-1_1.dll

    Filesize

    670KB

    MD5

    fe1f3632af98e7b7a2799e3973ba03cf

    SHA1

    353c7382e2de3ccdd2a4911e9e158e7c78648496

    SHA256

    1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

    SHA512

    a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\python38.dll

    Filesize

    4.0MB

    MD5

    d2a8a5e7380d5f4716016777818a32c5

    SHA1

    fb12f31d1d0758fe3e056875461186056121ed0c

    SHA256

    59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

    SHA512

    ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\select.pyd

    Filesize

    26KB

    MD5

    6ae54d103866aad6f58e119d27552131

    SHA1

    bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

    SHA256

    63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

    SHA512

    ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\tinyaes.cp38-win_amd64.pyd

    Filesize

    55KB

    MD5

    4fac6e7c3d2c3ccdb0e7019b4583e22e

    SHA1

    474cc332da8473e0f06c111a8c2a6e9d7bc1b56c

    SHA256

    b2bbe45b5ffa9b80b9ad75ead8cb1e816ee7b006a9677933dea5b4e0e06c4e3f

    SHA512

    360977d8c04e1da7e768d488bf50285ec3734f18cbcb32dcd4a57a04352fd381751ea0364f4224fbcdbc08f6c00c5374986ec16969b76ad9ec37d3f04474b3d0

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\ucrtbase.dll

    Filesize

    992KB

    MD5

    0e0bac3d1dcc1833eae4e3e4cf83c4ef

    SHA1

    4189f4459c54e69c6d3155a82524bda7549a75a6

    SHA256

    8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

    SHA512

    a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

  • C:\Users\Admin\AppData\Local\Temp\_MEI46762\unicodedata.pyd

    Filesize

    1.0MB

    MD5

    4c0d43f1a31e76255cb592bb616683e7

    SHA1

    0a9f3d77a6e064baebacacc780701117f09169ad

    SHA256

    0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

    SHA512

    b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778