Overview

overview

4

Static

static

1

python-3.1...64.exe

windows7-x64

4

python-3.1...64.exe

windows10-2004-x64

4

Resubmissions

05-07-2024 23:04

240705-22ners1brd 6

05-07-2024 23:03

240705-21x8ksybrr 4

05-07-2024 23:00

240705-2y63ps1blb 6

05-07-2024 22:56

240705-2w6zxs1aqa 4

Analysis

  • max time kernel
    1563s
  • max time network
    1565s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05-07-2024 23:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    python-3.12.4-amd64.exe

  • Size

    25.5MB

  • MD5

    f3df1be26cc7cbd8252ab5632b62d740

  • SHA1

    3b1f54802b4cb8c02d1eb78fc79f95f91e8e49e4

  • SHA256

    da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258

  • SHA512

    2f9a11ffae6d9f1ed76bf816f28812fcba71f87080b0c92e52bfccb46243118c5803a7e25dd78003ca7d66501bfcdce8ff7c691c63c0038b0d409ca3842dcc89

  • SSDEEP

    786432:zRd0l0X/46+nq1rcVqA5Z2bQcLsv0GlYrJF55e2nRk:L5P46+q1QTILMKB5e2nRk

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe
    "C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\Temp\{509F9210-8FF8-4636-A348-E0A057138FAA}\.cr\python-3.12.4-amd64.exe
      "C:\Windows\Temp\{509F9210-8FF8-4636-A348-E0A057138FAA}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.12.4-amd64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\{74C80EA0-5D73-4D66-ABD2-F64DCB6F4DF8}\.ba\SideBar.png
    Filesize

    50KB

    MD5

    888eb713a0095756252058c9727e088a

    SHA1

    c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

    SHA256

    79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

    SHA512

    7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

    Download Submit

  • \Windows\Temp\{509F9210-8FF8-4636-A348-E0A057138FAA}\.cr\python-3.12.4-amd64.exe
    Filesize

    858KB

    MD5

    504fdaeaa19b2055ffc58d23f830e104

    SHA1

    7071c8189d1ecd09173111f9787888723040433f

    SHA256

    8f211f3b8af3a2e6fd4aff1ac27a1ad9cd9737524e016b2e3bfc689dfdad95fb

    SHA512

    01aa983cbddfe38e69f381e8f8e66988273ef453b095012f9c0eeae01d39e32deb0e6fb369363cbb5e387485be33a53ac3ec16d3de1f42bb2cde0cfa05ceb366

    Download Submit

  • \Windows\Temp\{74C80EA0-5D73-4D66-ABD2-F64DCB6F4DF8}\.ba\PythonBA.dll
    Filesize

    675KB

    MD5

    e58bf4439057b22e6db8735be19d61ad

    SHA1

    415e148ecf78754a72de761d88825366aaf7afa1

    SHA256

    e3d3f38fd9a32720db3a65180857497d9064cffe0a54911c96b6138a17199058

    SHA512

    8d3523a12ee82123a17e73e507d42ae3248bd5c0aa697d5a379e61b965781bd83c0c97de41104b494b1f3b42127ab4b48ac9a071d5194a75c2af107016fc8c9c

    Download Submit