Malware Analysis Report

2024-11-30 13:17

Sample ID 240620-1nwcsaydjh
Target 49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076
SHA256 49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076

Threat Level: Shows suspicious behavior

The file 49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076 was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Unsigned PE

Detects Pyinstaller

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 21:48

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 21:48

Reported

2024-06-20 21:50

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI20642\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-core-localization-l1-2-0.dll

MD5 3589557535bba7641da3d76eefb0c73d
SHA1 6f63107c2212300c7cd1573059c08b43e5bd9b95
SHA256 642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6
SHA512 7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-core-processthreads-l1-1-1.dll

MD5 774aa9f9318880cb4ad3bf6f464da556
SHA1 3a5c07cf35009c98eb033e1cbde1900135d1abf8
SHA256 ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346
SHA512 f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-core-file-l1-2-0.dll

MD5 2b36752a5157359da1c0e646ee9bec45
SHA1 708aeb7e945c9c709109cea359cb31bd7ac64889
SHA256 3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc
SHA512 fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-core-timezone-l1-1-0.dll

MD5 b9a20c9223d3e3d3a0c359f001ce1046
SHA1 9710b9a8c393ba00c254cf693c7c37990c447cc8
SHA256 00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068
SHA512 a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI20642\python38.dll

MD5 d2a8a5e7380d5f4716016777818a32c5
SHA1 fb12f31d1d0758fe3e056875461186056121ed0c
SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512 ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

C:\Users\Admin\AppData\Local\Temp\_MEI20642\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-runtime-l1-1-0.dll

MD5 364bc49cc7034f8a9981ade1ce565229
SHA1 fbd76c1842d1ccf563ece2db32fff4c71e7ca689
SHA256 6254fd07ace88685112e3a7b73676aabf13a1b1bc30c55dd976b34fea12b7f1d
SHA512 65e59e3358eb1bf26823c9538c74d343e7383591c021d2b340ef68aa9a274d65b15b30bbbe55f4b32e3a08fc79d4e179a6ce92eadb8c4be09a2c35c348ce10af

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-string-l1-1-0.dll

MD5 f9297b9ff06295bc07b7e5281b1face0
SHA1 d0eb0fddbb3eb187df0f0e5f9ddffcfc2e05f9b7
SHA256 c56a2ee0cc6dc1e7283b9bda8b7b2dba957329cb4bc9aca4cd99f88e108f9c04
SHA512 bec6222776015996eba744698d3254945dfe4bb4dc0d85528ee59a0f3b5fc5bb054bbf496d562cfc7b4cc81b4d3df5c53761931162a0091a49386233afba4f9c

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-heap-l1-1-0.dll

MD5 4b038cdc70357d2dec440717ac344a52
SHA1 f67ba87f6830858845a5763381a47893af061bf8
SHA256 6a24e9cfb0efd9e1b90053d4ebd87fc35144e61ae3f6555c7d400542d648e2b5
SHA512 9557f15fa3c06de89ea8be0c959b94575a1c4587151687730f9e66fed095feb882d43ea32262000f871e6d860ce0c6c341cf5509a6ce81866f6d0efacb8526fe

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-stdio-l1-1-0.dll

MD5 8341f0371e25b8077fe61c89a9ef8144
SHA1 fc185203e33abed12e1398440cb2ee283ca9541a
SHA256 bd9a5d4554ef1a374257e8dd9436d89f686006ed1fd1cc44364b237bf5b795ff
SHA512 9c7e4e8d8e9e620f441ab5106820ec021d2b2323f44ed8cc8ec9673745dbc531347356f1ff195d63b62b09cc5c27e8f8641ce25be12ee9b700b5fc766337228b

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-convert-l1-1-0.dll

MD5 87e2934e49d7d111f383673f97d5029e
SHA1 267603d5510b775de3667f7d92bfaa3bd60e6533
SHA256 fb9dd774b25ab8e661c922caffb976c37a4d10a631ab65665da60016ef0c4d7c
SHA512 e6025ad419359ad3e06cc7a3b3b7436464dbbc71b91653833575264a5f8b0d781844a411bcd915d404b9a8c0a056eaf6d4d412723936845b53bfb5368bf5f7a7

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-math-l1-1-0.dll

MD5 a592d1b2ecc42d1a083f0d34feae2444
SHA1 29718af390f832626fcdcc57c107333cdb5743e1
SHA256 18a827b01de7b1a3d5c8d17b79ad2462a90308124448a9b8c47eccda39c3a095
SHA512 44bed6d24f1fa35b10d2b2b1574e7baf10182e60fdcb6cba5dd9de5cd7a5183198925e4fa5a7e2896564a30f7b70de69691713118d59bf5162ce35aff5bcf7a6

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-locale-l1-1-0.dll

MD5 75f1a5f65790560d9544f3fb70efba51
SHA1 f30a5751901cfffc250be76e13a8b711ebc06bcc
SHA256 e0e02ea6c17da186e25e352b78c80b1b3511b5c1590e5ba647b14a7b384af0f8
SHA512 b7e285ca35f6a8ae2ccbe21594d72152175301a02ad6b92fe130e1e226a0faad1bfad1bd49857401549c09b50feee2c42c23ca4c19b2845cad090f5b9e8e8f63

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-time-l1-1-0.dll

MD5 816a8932759bdb478d4263cacbf972e3
SHA1 ac9f2bed41e340313501aa7d33dcd369748f0496
SHA256 ce9a8e18923d12e2f62ce2a20693113000fc361cc816773037c155c273b99e7c
SHA512 5144f01bee04455d5b9a7b07e62f4afb928605331213eb483265016640198c175dc08673903ed5bc16b385ee76657aa4303776233d04347d9d1daadce39525c4

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-process-l1-1-0.dll

MD5 e3914d51afd864a6c6587aa9192c491b
SHA1 bae85701809bc259a8744aafa45cd7159e6c13f8
SHA256 28257cc063431f78284335ce3002ffb71b75c1e7ccabf5417bb42392c35564b4
SHA512 43b1445a80d309ec73d52d6cf68f4533a132fb55ab672e5e2a878bb42c1cb36d6e4c504d43fa4923e692c8be600f3f9d5a5edde80602636cb726eedfca23dfb8

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-environment-l1-1-0.dll

MD5 e41612752a7dfbbe756322cf48e106b9
SHA1 0ec106e926c9837a43e1d7ec8d1a5f03edd5ec3d
SHA256 4bb9d36e0e034652f2331ddb43ee061608f436cbc9e5771b4d27b28fa10f5248
SHA512 9bed9399e896d1cc58cc06e8d7ec6cc3345be6d15ca307c670e0f282c9ebe48a6cc1b145c2ecf94d84214cddff8f0d0d720ea984478c74c98e2499c2184638c9

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-conio-l1-1-0.dll

MD5 9eb2c06decaae1a109a94886a26eec25
SHA1 307ce096bee44f54a6d37aab1ef123fb423ed028
SHA256 da8fd2fe08a531d2331c1fbee9f4ae9015b64f24a2654a7f82418c86b4ab6909
SHA512 7e701cb00a4cab8d5b3ecf55a16fef0103f9be1aa3fd7b53c7bab968708c21e8d1c763ad80a7a8d6c76dd45ddd244c9c9e8944455c2025b4195660b61ac1e8b7

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 102a8c01049ef18cc6e8798a9e5d57f4
SHA1 9adef547e03032d8c5525cc9c7d4512fbeb53948
SHA256 e13edab280e7b3410d7f4ce30a8e8cae64f38652d770fc3bf223206f0c57aaa5
SHA512 a9fbc726f33399f55f70967f3f1bf374589eaad9581d9e94228d39afa06cdce31ed25bdc04805aad361c7cafbeb56ca39f6693259d67457199d4423a61b32263

C:\Users\Admin\AppData\Local\Temp\_MEI20642\base_library.zip

MD5 4b0f4f93f77753fcc507899ec698d3c2
SHA1 3db59eecafab5f9e0f9eaf6084eb38470a3f5c80
SHA256 41321aae8a8ef02cb511bfceff167b5a255120c8998b8241e6738c35fce3bddd
SHA512 33d9e349d38896c53bfef2ea5103a6ab764ea8069602f7509576668a630607d22ee13516707754cdd8763a1eaf5229dc8b2e4f26527b75023e12f6d2d89cc17d

C:\Users\Admin\AppData\Local\Temp\_MEI20642\tinyaes.cp38-win_amd64.pyd

MD5 4fac6e7c3d2c3ccdb0e7019b4583e22e
SHA1 474cc332da8473e0f06c111a8c2a6e9d7bc1b56c
SHA256 b2bbe45b5ffa9b80b9ad75ead8cb1e816ee7b006a9677933dea5b4e0e06c4e3f
SHA512 360977d8c04e1da7e768d488bf50285ec3734f18cbcb32dcd4a57a04352fd381751ea0364f4224fbcdbc08f6c00c5374986ec16969b76ad9ec37d3f04474b3d0

C:\Users\Admin\AppData\Local\Temp\_MEI20642\_ssl.pyd

MD5 8ee827f2fe931163f078acdc97107b64
SHA1 149bb536f3492bc59bd7071a3da7d1f974860641
SHA256 eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4
SHA512 a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

C:\Users\Admin\AppData\Local\Temp\_MEI20642\libcrypto-1_1.dll

MD5 bf83f8ad60cb9db462ce62c73208a30d
SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

C:\Users\Admin\AppData\Local\Temp\_MEI20642\api-ms-win-crt-utility-l1-1-0.dll

MD5 57d3ee548db3a503ac391af798e0e2a2
SHA1 d686a96c5046d6d7a022c4266a5d0014745360a4
SHA256 2c80280e51c242466e10a36a0bf2a341607983b6f6648f93b0718b34ab5285c5
SHA512 f3ea9c8f2f230d23bc878e37044599b2c77f0bf6dd84b07c2f87a84263fb9ac7f44732f05e14781b6046afb2a39f27135c96d2da2ab9605bd00e55d9b0fffb0b

C:\Users\Admin\AppData\Local\Temp\_MEI20642\libssl-1_1.dll

MD5 fe1f3632af98e7b7a2799e3973ba03cf
SHA1 353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512 a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

C:\Users\Admin\AppData\Local\Temp\_MEI20642\_socket.pyd

MD5 d6bae4b430f349ab42553dc738699f0e
SHA1 7e5efc958e189c117eccef39ec16ebf00e7645a9
SHA256 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
SHA512 a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

C:\Users\Admin\AppData\Local\Temp\_MEI20642\select.pyd

MD5 6ae54d103866aad6f58e119d27552131
SHA1 bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
SHA512 ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

C:\Users\Admin\AppData\Local\Temp\_MEI20642\_hashlib.pyd

MD5 a6448bc5e5da21a222de164823add45c
SHA1 6c26eb949d7eb97d19e42559b2e3713d7629f2f9
SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
SHA512 a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

C:\Users\Admin\AppData\Local\Temp\_MEI20642\_queue.pyd

MD5 44b72e0ad8d1e1ec3d8722088b48c3c5
SHA1 e0f41bf85978dd8f5abb0112c26322b72c0d7770
SHA256 4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e
SHA512 05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

C:\Users\Admin\AppData\Local\Temp\_MEI20642\charset_normalizer\md.cp38-win_amd64.pyd

MD5 38105df780eddd734027328e0dca0ca3
SHA1 45f1d9e3472478f8e1ba86675f5c81c00b183bea
SHA256 9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb
SHA512 ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

C:\Users\Admin\AppData\Local\Temp\_MEI20642\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

MD5 073f09e1edf5ec4173ce2de1121b9dd1
SHA1 6cdb2559a1b706446cdd993e6fd680095e119b2e
SHA256 7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c
SHA512 70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

C:\Users\Admin\AppData\Local\Temp\_MEI20642\unicodedata.pyd

MD5 4c0d43f1a31e76255cb592bb616683e7
SHA1 0a9f3d77a6e064baebacacc780701117f09169ad
SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
SHA512 b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 21:48

Reported

2024-06-20 21:50

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe

"C:\Users\Admin\AppData\Local\Temp\49df0fe32131356991b23b112e767882f2322af0e087be4577a758b2bca16076.exe"

Network

Files

C:\Users\Admin\AppData\Local\Temp\_MEI46762\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI46762\python38.dll

MD5 d2a8a5e7380d5f4716016777818a32c5
SHA1 fb12f31d1d0758fe3e056875461186056121ed0c
SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
SHA512 ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

C:\Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

C:\Users\Admin\AppData\Local\Temp\_MEI46762\base_library.zip

MD5 4b0f4f93f77753fcc507899ec698d3c2
SHA1 3db59eecafab5f9e0f9eaf6084eb38470a3f5c80
SHA256 41321aae8a8ef02cb511bfceff167b5a255120c8998b8241e6738c35fce3bddd
SHA512 33d9e349d38896c53bfef2ea5103a6ab764ea8069602f7509576668a630607d22ee13516707754cdd8763a1eaf5229dc8b2e4f26527b75023e12f6d2d89cc17d

C:\Users\Admin\AppData\Local\Temp\_MEI46762\tinyaes.cp38-win_amd64.pyd

MD5 4fac6e7c3d2c3ccdb0e7019b4583e22e
SHA1 474cc332da8473e0f06c111a8c2a6e9d7bc1b56c
SHA256 b2bbe45b5ffa9b80b9ad75ead8cb1e816ee7b006a9677933dea5b4e0e06c4e3f
SHA512 360977d8c04e1da7e768d488bf50285ec3734f18cbcb32dcd4a57a04352fd381751ea0364f4224fbcdbc08f6c00c5374986ec16969b76ad9ec37d3f04474b3d0

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ssl.pyd

MD5 8ee827f2fe931163f078acdc97107b64
SHA1 149bb536f3492bc59bd7071a3da7d1f974860641
SHA256 eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4
SHA512 a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

C:\Users\Admin\AppData\Local\Temp\_MEI46762\libssl-1_1.dll

MD5 fe1f3632af98e7b7a2799e3973ba03cf
SHA1 353c7382e2de3ccdd2a4911e9e158e7c78648496
SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
SHA512 a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

C:\Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-1_1.dll

MD5 bf83f8ad60cb9db462ce62c73208a30d
SHA1 f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512 ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

C:\Users\Admin\AppData\Local\Temp\_MEI46762\select.pyd

MD5 6ae54d103866aad6f58e119d27552131
SHA1 bc53a92a7667fd922ce29e98dfcf5f08f798a3d2
SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
SHA512 ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_hashlib.pyd

MD5 a6448bc5e5da21a222de164823add45c
SHA1 6c26eb949d7eb97d19e42559b2e3713d7629f2f9
SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
SHA512 a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_queue.pyd

MD5 44b72e0ad8d1e1ec3d8722088b48c3c5
SHA1 e0f41bf85978dd8f5abb0112c26322b72c0d7770
SHA256 4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e
SHA512 05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

MD5 073f09e1edf5ec4173ce2de1121b9dd1
SHA1 6cdb2559a1b706446cdd993e6fd680095e119b2e
SHA256 7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c
SHA512 70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md.cp38-win_amd64.pyd

MD5 38105df780eddd734027328e0dca0ca3
SHA1 45f1d9e3472478f8e1ba86675f5c81c00b183bea
SHA256 9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb
SHA512 ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

C:\Users\Admin\AppData\Local\Temp\_MEI46762\unicodedata.pyd

MD5 4c0d43f1a31e76255cb592bb616683e7
SHA1 0a9f3d77a6e064baebacacc780701117f09169ad
SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
SHA512 b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_socket.pyd

MD5 d6bae4b430f349ab42553dc738699f0e
SHA1 7e5efc958e189c117eccef39ec16ebf00e7645a9
SHA256 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
SHA512 a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_lzma.pyd

MD5 37057c92f50391d0751f2c1d7ad25b02
SHA1 a43c6835b11621663fa251da421be58d143d2afb
SHA256 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
SHA512 953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

C:\Users\Admin\AppData\Local\Temp\_MEI46762\certifi\cacert.pem

MD5 2a6bef11d1f4672f86d3321b38f81220
SHA1 b4146c66e7e24312882d33b16b2ee140cb764b0e
SHA256 1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c
SHA512 500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9

C:\Users\Admin\AppData\Local\Temp\_MEI46762\_bz2.pyd

MD5 3dc8af67e6ee06af9eec52fe985a7633
SHA1 1451b8c598348a0c0e50afc0ec91513c46fe3af6
SHA256 c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
SHA512 da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087