b8a1e46ef14be22cfa81ffe3ed1ed5bbcb7b976d0ddaae57e842123699ac7bfe

Analysis

max time kernel
133s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pluto/files/Wifi-Multitool.exe
Size

5.7MB
MD5

6f1d91ef2641a2d852f51516e75ba4f0
SHA1

7bec1d2a377de433c0a921365e29bc2b4bfa1b7b
SHA256

047e39242d5f2be33fc5b6985d9dd8349049112c97a69281310fc9b5861de398
SHA512

986d5076d12d7286ad80a06974f3ec4b90becf6da8940e87a7556ce3380d65c079182c5e4c02dd141469cedfdcd4682e44905ea9584c508d2f557768a2c1309b
SSDEEP

98304:er68wcqmbxaQBNBU5ytgMwzu+Zkh/tLiclDXc3/Zpjx0bU0p6bEWq4:em0xbAQveItwq+ZkiKDIjx0vUDq

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2728	Wifi-Multitool.exe
2728	Wifi-Multitool.exe
2728	Wifi-Multitool.exe
2728	Wifi-Multitool.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2728	4824	Wifi-Multitool.exe	91
PID 4824 wrote to memory of 2728	4824	Wifi-Multitool.exe	91
PID 2728 wrote to memory of 2172	2728	Wifi-Multitool.exe	92
PID 2728 wrote to memory of 2172	2728	Wifi-Multitool.exe	92

C:\Users\Admin\AppData\Local\Temp\pluto\files\Wifi-Multitool.exe
"C:\Users\Admin\AppData\Local\Temp\pluto\files\Wifi-Multitool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\pluto\files\Wifi-Multitool.exe
  "C:\Users\Admin\AppData\Local\Temp\pluto\files\Wifi-Multitool.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI48242\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48242\_ctypes.pyd

Filesize
120KB

MD5
462fd515ca586048459b9d90a660cb93

SHA1
06089f5d5e2a6411a0d7b106d24d5203eb70ec60

SHA256
bf017767ac650420487ca3225b3077445d24260bf1a33e75f7361b0c6d3e96b4

SHA512
67851bdbf9ba007012b89c89b86fd430fce24790466fefbb54431a7c200884fc9eb2f90c36d57acd300018f607630248f1a3addc2aa5f212458eb7a5c27054b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48242\base_library.zip

Filesize
1.0MB

MD5
172a5e453085c183a1e234bc92200eb2

SHA1
59ee797cda917703b07764222bd34d778101d35a

SHA256
92a42ff8b7e0d65c58776de5776e9eb5eb7e5bcd58111107aa3b0cc8abaf7ffe

SHA512
292d48a1cdbe80f066f9aff4ae66fd9a5356d018dd0fee6a7a31c142f6315469fae217d256eda949446443f37e6bef670a46f1a35594ed8bd15ae65612b73e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48242\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48242\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads