Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/06/2024, 19:15

General

  • Target

    Akuma/lib/speak/curl/bookmarks_parser.exe

  • Size

    4.9MB

  • MD5

    0024fb2a8b21fd0b100b4569fb2db2de

  • SHA1

    e0e29770b67a8462849fb8e550a50ee802a9591e

  • SHA256

    a1be50e4f27588775579853e450b80495a8e54b441ac0d1bb289eecc595674b2

  • SHA512

    1dbe968ce41b783aa2f916a6a7fa1d34a1e82552cdff300d0ce449f1afdba28fd7bc81cb785f9ec5417edf6aaa428d4d2007208876fb4f130e3ede188865c7b7

  • SSDEEP

    98304:PWZpdAeYVH917pxX+T5zCTZT6FQ/C3QnVDZhWwA7r3vsQBaWlhTV5qc5k+QH:ejAeEPK9C6Q/OQVtQw2r3vpEcLIc

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\bookmarks_parser.exe
    "C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\bookmarks_parser.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\bookmarks_parser.exe
      "C:\Users\Admin\AppData\Local\Temp\Akuma\lib\speak\curl\bookmarks_parser.exe"
      2⤵
      • Loads dropped DLL
      PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\VCRUNTIME140.dll

    Filesize

    81KB

    MD5

    5116fd80399d5af500badb186c866cde

    SHA1

    8dfbcdd296383aebc039058101aac1ae408e5152

    SHA256

    1e5dc86e122379740724621890a1ba1b18252c745631a6dff862aa7723a1f99a

    SHA512

    e41b71380fa49743f1efcc920276dbf1b2f7f5db5771f64a4d2ff18039c124efdb3b7d3fa66eda2c47b21012abe1186eade388b38dcaa7e8417707be546c65d4

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_bz2.pyd

    Filesize

    70KB

    MD5

    69571f3b3b8a1101515e4aee7f080cd1

    SHA1

    67cbcbac47499b15a60343b67a80cd16c4a9c197

    SHA256

    7a9c1b992529281ffc38944580dd858e85d4a76620c768839fb7fb7c21771989

    SHA512

    5b110ce65a93e03205fc4bac5fb2c83e3f67aae1e84a1d5503589ce43e843c29a31379c013e43533c84e70c0a82e5db8fbe63a678e20b8cefa515199bc599c6d

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\_lzma.pyd

    Filesize

    137KB

    MD5

    76677f460125603976656f78b8af6b56

    SHA1

    0664d710ef55f5c58178ce44c185a4c0ad10a31a

    SHA256

    a8f71849e92ef2455488b5a9334bd0c378b92f75b089b3eddb284c0ca545060a

    SHA512

    60a8d0c95553700ad5c18f4c5fc5475e22c8d42ccbe7bc26530649695e18cecf2202c55bd4c7d3a943a018f6737b9ef262f52cf75c5e8df63d72eca40fcff442

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\base_library.zip

    Filesize

    1008KB

    MD5

    3c39f09efc25551e8d79d60ac23d205c

    SHA1

    c965fc04fbf09de3cf012dd8171c707d717da537

    SHA256

    52e1825807e78e761671a757848e3eac5f1c19fd26b1e238846b4086d0b01809

    SHA512

    63323c079dd880058c3a1af8c6dd6df969d3b662a358b1b09273c401cd7cf2e0c1dbfa6cf65b5df201aaaa11c46188a2e13ec909cdfd8e1263cb1b129ddd06ab

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\python38.dll

    Filesize

    3.5MB

    MD5

    21af5002786204a0fce0ebab2643f12a

    SHA1

    b9920ca2c11205186e77b8d35021137c474abe91

    SHA256

    d65d664fca161565b20e114a6b6ddb0cec7cfcb7d6f04d431fd64cdbeeed48b7

    SHA512

    76ed9de199ac156853126ea74016dead74a14223fdf9688bb7cf2be191caa76c70fcc4d8577264b98f386270b56a83454636581bf06f7f905e8ca1dea6386cbf

  • C:\Users\Admin\AppData\Local\Temp\_MEI19082\ucrtbase.dll

    Filesize

    893KB

    MD5

    a924b24d71829da17e8908e05a5321e4

    SHA1

    fa5c69798b997c34c87a8b32130f664cdef8c124

    SHA256

    f32a61d91264aff96efd719915bed80785a8db4c8d881d6da28909b620fe466f

    SHA512

    9223ec0e6e0f70b92473e897e4fd4635a19e9ca3aff2fe7c5c065764b58e86460442991787525ed53e425ecd36f2881a6df34c35d2a0e21b7ac4bc61bf1cbeab