Malware Analysis Report

2024-11-30 13:18

Sample ID 240620-1q36eayejf
Target 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9
SHA256 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9

Threat Level: Shows suspicious behavior

The file 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9 was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Detects Pyinstaller

Unsigned PE

Detects videocard installed

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 21:52

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 21:52

Reported

2024-06-20 21:54

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe
PID 1856 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe
PID 1436 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\SYSTEM32\getmac.exe
PID 1436 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 640 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 640 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3656 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3656 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 232 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 232 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1436 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 2148 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2148 wrote to memory of 396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1436 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 1436 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe C:\Windows\system32\cmd.exe
PID 2652 wrote to memory of 3392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2652 wrote to memory of 3392 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 924 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 924 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\SYSTEM32\getmac.exe

getmac

C:\Windows\SYSTEM32\getmac.exe

getmac

C:\Windows\SYSTEM32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:57084 tcp
N/A 127.0.0.1:57093 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI18562\python310.dll

MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

C:\Users\Admin\AppData\Local\Temp\_MEI18562\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

C:\Users\Admin\AppData\Local\Temp\_MEI18562\base_library.zip

MD5 c4989bceb9e7e83078812c9532baeea7
SHA1 aafb66ebdb5edc327d7cb6632eb80742be1ad2eb
SHA256 a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd
SHA512 fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_ctypes.pyd

MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

C:\Users\Admin\AppData\Local\Temp\_MEI18562\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_uuid.pyd

MD5 b68c98113c8e7e83af56ba98ff3ac84a
SHA1 448938564559570b269e05e745d9c52ecda37154
SHA256 990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2
SHA512 33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_ssl.pyd

MD5 7910fb2af40e81bee211182cffec0a06
SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_socket.pyd

MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_queue.pyd

MD5 d8c1b81bbc125b6ad1f48a172181336e
SHA1 3ff1d8dcec04ce16e97e12263b9233fbf982340c
SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
SHA512 ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_pytransform.dll

MD5 0b8bd756986d587baa5adc00173991dd
SHA1 c8db5f2e4802917796d34d5de11421d488b3fcbd
SHA256 37847d77839485d9c3029032ed4f447f3e7240421b28730efd5f57ddbb6b3f52
SHA512 ce0d830444b5a99a55d6471e5792310cd2791bc53d61c23917b2ab337c275822cbafa1f61770c6e559d90ce46d751a46d030e2340779ba3409beddfc4efd2a3e

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_overlapped.pyd

MD5 fdf8663b99959031780583cce98e10f5
SHA1 6c0bafc48646841a91625d74d6b7d1d53656944d
SHA256 2ebbb0583259528a5178dd37439a64affcb1ab28cf323c6dc36a8c30362aa992
SHA512 a5371d6f6055b92ac119a3e3b52b21e2d17604e5a5ac241c008ec60d1db70b3ce4507d82a3c7ce580ed2eb7d83bb718f4edc2943d10cb1d377fa006f4d0026b6

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_multiprocessing.pyd

MD5 a9a0588711147e01eed59be23c7944a9
SHA1 122494f75e8bb083ddb6545740c4fae1f83970c9
SHA256 7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c
SHA512 6b580f5c53000db5954deb5b2400c14cb07f5f8bbcfc069b58c2481719a0f22f0d40854ca640ef8425c498fbae98c9de156b5cc04b168577f0da0c6b13846a88

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_lzma.pyd

MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_hashlib.pyd

MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_decimal.pyd

MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_bz2.pyd

MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

C:\Users\Admin\AppData\Local\Temp\_MEI18562\_asyncio.pyd

MD5 33d0b6de555ddbbbd5ca229bfa91c329
SHA1 03034826675ac93267ce0bf0eaec9c8499e3fe17
SHA256 a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5
SHA512 dbbd1ddfa445e22a0170a628387fcf3cb95e6f8b09465d76595555c4a67da4274974ba7b348c4c81fe71c68d735c13aacb8063d3a964a8a0556fb000d68686b7

C:\Users\Admin\AppData\Local\Temp\_MEI18562\VCRUNTIME140_1.dll

MD5 135359d350f72ad4bf716b764d39e749
SHA1 2e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512 cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

C:\Users\Admin\AppData\Local\Temp\_MEI18562\unicodedata.pyd

MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

C:\Users\Admin\AppData\Local\Temp\_MEI18562\select.pyd

MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

C:\Users\Admin\AppData\Local\Temp\_MEI18562\pyexpat.pyd

MD5 1118c1329f82ce9072d908cbd87e197c
SHA1 c59382178fe695c2c5576dca47c96b6de4bbcffd
SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
SHA512 29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa

C:\Users\Admin\AppData\Local\Temp\_MEI18562\libssl-1_1.dll

MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

C:\Users\Admin\AppData\Local\Temp\_MEI18562\libcrypto-1_1.dll

MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

memory/1436-64-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-86-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-118-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-116-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-114-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-112-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-108-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-106-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-104-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-102-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-100-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-98-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-96-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-94-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-92-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-90-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-88-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-84-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-82-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-80-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-78-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-76-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-74-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-72-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-70-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-68-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-66-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-110-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-62-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-60-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-58-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-56-0x000002380F300000-0x000002380F301000-memory.dmp

memory/1436-55-0x000002380F2F0000-0x000002380F2F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI18562\win32\win32api.pyd

MD5 00e5da545c6a4979a6577f8f091e85e1
SHA1 a31a2c85e272234584dacf36f405d102d9c43c05
SHA256 ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee
SHA512 9e4f834f56007f84e8b4ec1c16fb916e68c3baadab1a3f6b82faf5360c57697dc69be86f3c2ea6e30f95e7c32413babbe5d29422d559c99e6cf4242357a85f31

C:\Users\Admin\AppData\Local\Temp\_MEI18562\pywin32_system32\pywintypes310.dll

MD5 ceb06a956b276cea73098d145fa64712
SHA1 6f0ba21f0325acc7cf6bf9f099d9a86470a786bf
SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
SHA512 05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 21:52

Reported

2024-06-20 21:54

Platform

win7-20240611-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe

"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI21082\python310.dll

MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b