Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-de -
resource tags
arch:x64arch:x86image:win10v2004-20240709-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
13-07-2024 18:50
Behavioral task
behavioral1
Sample
samples_pcap.zip
Resource
win10v2004-20240709-de
Behavioral task
behavioral2
Sample
25af3ae9f4ebe5413b0ca1080b69b0ca.exe
Resource
win10v2004-20240709-de
Behavioral task
behavioral3
Sample
payload.pyc
Resource
win10v2004-20240709-de
Behavioral task
behavioral4
Sample
25af3ae9f4ebe5413b0ca1080b69b0ca.pcap
Resource
win10v2004-20240709-de
Behavioral task
behavioral5
Sample
decryptor.exe
Resource
win10v2004-20240709-de
Behavioral task
behavioral6
Sample
decryptor.pyc
Resource
win10v2004-20240709-de
General
-
Target
decryptor.exe
-
Size
9.6MB
-
MD5
4de3f7ed12fda2142563c791fe609867
-
SHA1
bce2ddb9861406067270a6e3bd19c42f50babc0d
-
SHA256
3f03e20b29331ecd88d69309adb9897ce749265441f13e049c458894fbc189ca
-
SHA512
13c8c101655f1169ac9a66ce62aae426b73d33c1a43923a2bd9847493b7b068f630e9cb9e1593cb23fd0120dc4a84f4809ba37a110da49187b0d1a2bf0ca48f8
-
SSDEEP
196608:ZegEmz+mWeeNuWJysVYvsO2DeECRl2Ewf8jI48RmU/3ZlsPv+djd8CaL3:QmXWeeEWJ4HykUtN3ZWMs3
Malware Config
Signatures
-
Loads dropped DLL 27 IoCs
Processes:
decryptor.exepid Process 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe 3036 decryptor.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
decryptor.exedescription pid Process Token: 35 3036 decryptor.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
decryptor.exepid Process 3036 decryptor.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
decryptor.exedescription pid Process procid_target PID 2204 wrote to memory of 3036 2204 decryptor.exe 85 PID 2204 wrote to memory of 3036 2204 decryptor.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\decryptor.exe"C:\Users\Admin\AppData\Local\Temp\decryptor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\decryptor.exe"C:\Users\Admin\AppData\Local\Temp\decryptor.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5346613b7b5476bc5e0f2052337096745
SHA130d6f7dbeaca01e4b68c62441fcd7e96e5e3c318
SHA2568e321257df73855dd2c676211bc701417615036486d86c26a2d534eb3d012cc2
SHA51215923a468a68f89de1e023e788d0a5ce924cde0211d31a1d0244b01b938634988ea1cae677c8c0f0b7fbf60ea80bcfa0998869a5b5a4111ac641c9365b73c8fb
-
Filesize
33KB
MD529dc40ca28734062927e35f159045d00
SHA120b99cc2e47dee0588b4b3e3620d9adaa51dceb1
SHA25662a8dfd622505d3961b53ec718d4b1fa7932996921a70e5043d28c82014c958f
SHA51230e19fc9b24bcfc8c78452a20011769b8bb45ba49b98892b61fe1e401dce46099e67b6c199acbd480e4fdba75af7bfa6ae9a6915cf08397f0456c5ecb44da765
-
Filesize
15KB
MD594daf3da5654a5b4e98b45cf58d1ae17
SHA1c124196a6dd59bc206d474c3d5b8bea72f1f29b9
SHA2562331f45b306d6392f7f89a963a817d10621d5b1bb0bc3d6617e73aa7e9f595bd
SHA512535ef9fa091c76a35580e94906dbe9cfccf98fd57673fe3b4fabd1c9c20acfadb7d494a5cf395df2bf1f0f3241e2655e4c65b9482692dcda4ee98a1ebac80a27
-
Filesize
12KB
MD5975677038380fe2055348ef1cfead173
SHA1fc13d734e4a762692b4763b0bb69f54f65961baa
SHA256183c2b948acfee01ee53acdbcfd5ea1161819dd91e26a711f6bcae54ea4f1d68
SHA512a84a1a1babc5e29fe3b3b52da550506b4a51d9974c044cae977d22082b9293f72c55339b936b4b01e13ac7f482fd15bac20129ed008421e00270275970548447
-
Filesize
12KB
MD5eaeb30f73165bef13c17703e524ba4e7
SHA1375396d0d6287739a78d192b6c99f63adb850621
SHA25637dceb92e4712f70725b79309e1b3313c9a6fe4f0129eb873ec283f8a4fc966a
SHA5126a8997a2bd80c62cee369636b8e33130ab983b5a58211901312624d961fd8c2630eee10df7891bc87bfc51c85e6fae3eec1e7537c35859604db754084bfcf226
-
Filesize
13KB
MD59c4f7079923415405bdc57170343d276
SHA1a7c5fc789c34717efdf18afd6ad80aa638285a3e
SHA2560a3d953bbecd62553ec35ccd2b5e97e54849171ae3bec86361f18e5641f51cb4
SHA512fe950abae14646fcafa417395361cbeda0b9f939fc5a8cc9610791ffc7d37d6ea3f0ccb59d3b541afdf2cfea5477b612ca2881bce2aec011165c521c6ae4570b
-
Filesize
10KB
MD5dc7b8a32b583dddd095e4a586790e196
SHA1899addf5f7160c3e9dcf0b70a277b37f9cfe1a99
SHA2561e14ce917a8fda673def4e59ec95f3cbebc053adee0f4c1916b6cd580dc5451a
SHA51204a8cef79f8f644af9daf937c20c1372eea55c747e2e3ebc7511263cc6d803ca5d959f856bcab3d1df8ac98939b2eb66c5ae506418f8317475b566480fe32fb2
-
Filesize
14KB
MD5e53daac3d85f0601b1aea2eca1af10a0
SHA1f305f7b07835c1f25bc5c9e9edb49c465b420046
SHA2567154dcc37ba077948ce7030627933c230e6ee52e32599b45d1d8bb8012b9e52a
SHA512c5cbf4d8f639c719dbe2f16d0409fb22b4db220670ddf4a56f91cee81d8944ed9b7830d6753689c57295418a8aa385fec5b325ce5293e968436515a7cfed2487
-
Filesize
11KB
MD5f61b7704ddc6e8a3cdef746ce273e9b4
SHA1724ca28ece5e600397b37ca92ab73d8ef28420d1
SHA256bb04cfa6485c766cc980b317c4bc6afa776b9fb2f550cd24d4d31091942aa579
SHA51256b1f4f6aa275303afdd1ec292f4f5908bb2eae0d71236cb00ade785c74ea0180f494c78a73269c8a0532e4daa71cd9a5cbebde5db3788d93f343ac7f53bcae5
-
Filesize
14KB
MD580bcd0e98ccd489062d84d9fac968bdb
SHA14754c9ec593ff821c9249053eb5e257ccc6dc630
SHA2564fbdf3c3057e8eef60fa7382be1c303db96c06d3d846723ce19a5982d92d0179
SHA512f82a856bf72c3bd9906992d0733e4b0e6ec6d183e7557f431e2d8ed6f5a058f7ad1e7a9f4abf787f40bda800757dc03a64454df3183a1626096e78e85a0c6ed5
-
Filesize
15KB
MD501c4ff8f2c1b7de289412e0b991fc3ea
SHA1cf61c41da1d0828c585b00f1fe1a5806dfca4abe
SHA256f65db1b2870dd515a21f0a54c41648e46c084f69397b9e490c851dfbe16a94d1
SHA51220c5440dc6c2580b65c5554f1613dfc2fef564739f8ab53032806894521ac5459c5b616d2c95a01dbc68177e38079059da8bae033c25379b8a08a6eb9069a2bf
-
Filesize
18KB
MD5130c190ea34d050d11ddb438aa85ee38
SHA1608e400fc970d132081149284336f065532f50b2
SHA256c8b01a857fff18abda746b703376373b5f9b66eec8e4fee124dbd0dfab73cdbb
SHA5123109d48cb3bea9d061dfe1c22e0795dac12c8d5468fd866286fc9349876843f5650159f41afbb3162ce060ccd258486ddc2622fdd041f1d5c0867ac6577f59d9
-
Filesize
20KB
MD5604980ebcb7a6f094fafbf7fbddb024d
SHA10062fe88f899f28df8682be6e7820db51eb7ae50
SHA256cd7909a8da1136c930daab4b496640f6a23f89c6423e9e1cad829874ff499c6c
SHA5122fc270a5aca29157d82e0be5be1eb49bf58edeefd8591b72f1a2857a78c2d534dd0b3ddcbf702d3b741170fdd86e5fa901d1028a3cde2e8518fbdbf0f2bbb354
-
Filesize
13KB
MD5e59c51d2f581a9cde3d914c3682925f2
SHA129def1c0410fe12164e6900f7416b4d292eb18f2
SHA256d74e95af0cab39cdda8b462ac7b887d8214f3474a107db0d06e159096c0c0f44
SHA51240c71556c557da8fa847d5515c63546e38f08479a00c3a7d9032f664d9e75a8fb209f61a83f909c76c6adc8a44a2ab2272af730dd22fcb3ab25af9765424fb68
-
Filesize
12KB
MD54ebe6bb08637535072163687bebdcb75
SHA17ff36c26315f57b996a1866f2c6a68cffcb0638d
SHA2561435996cb9b84ffe2ebe2aa415bbae70708a052faf6d7c90dc8f40c979e03f66
SHA5123d60e6532f6af2e1e84163cc052de6691b51d191a519d620d7c40cc7295827a62c2263d86edce61fc4329d261cde9413143c630d077020c9d546ddc34ee00ee1
-
Filesize
12KB
MD5ce04b6e8504eeb82439db577b45cd064
SHA179a6e03f6e4a453497fdc0bd1c8da59992a052e9
SHA256d51ad472f474f02d03fac74fd7c13b57158227ac685494667cb9f1eb7c0ea313
SHA5125647e71dcfa00d2dc56b416bf52657207d7009066eed78c5d60c68b54c333e180fa7c1445d15dcf52237a635c7ff050236a883e33de3a6b2b08078ea731c4d80
-
Filesize
10KB
MD5abe63928bac4999e03f2499f0285cbe6
SHA1c85b49c25bceb3a9089d668af947f60794bec804
SHA256f86f141433cdbae6eddc1190be1e64ba9c205c65cb5d6af9d513315d0a4ac85d
SHA51252df415b1b3f05c86a9eb3319f40741cfa97e43f2fbe8263060b776938aadf1ee253de489e286d36b331abce40e0f95bd03f230506a917f94be1b6f691e14945
-
Filesize
10KB
MD58b0290798b02b21fb79521c7914b24f7
SHA12f7ab160f2bf26734ecffecba69889035e3bd930
SHA2562c21a97fb28c49b2d92ab0f6e7b3a55a821bc465ddcd4e29558a1d063d9fe5c1
SHA5129898575c8894599069877bbff9109b28ca624f5bb1ac88a623a5de4fa40a8e02c64dfbb2c142aac1a65ec6b7fa24c7f9399c28083a666e18fd68ea5b2e24a81e
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
87KB
MD58b40a68ae537c0aab25a8b30b10ab098
SHA11c8ac1f7f5c3697c457dd98f05296c2354ff7f55
SHA2560b86ef4810d53e79f1d934b427fdbacf3792eebb37ed241bc89148238af763fa
SHA512620ad61ff05c73adee4ac8f4b88a3880c11893eaac77ccca4e88edb29b492366a5bcf813d18628f005730f7e45ce373af9275776ea768b67b8d0e3bc62949229
-
Filesize
131KB
MD59a69561e94859bc3411c6499bc46c4bd
SHA13fa5bc2d4ffc23c4c383252c51098d6211949b99
SHA2566bbde732c5bcb89455f43f370a444bb6bca321825de56f9a1f2e947b0a006f1c
SHA51231d9e3844f1b8e72ec80acd1e224a94d11039c130e69c498a668e07e0d8bba8d1ed1ebe0b7a16376ca597d0e2b74a0d5e3bf53d1cbadf5bf099d3bf78db659a4
-
Filesize
251KB
MD516fb5a2363ce8dd12a65a9823a517b59
SHA159979d9195259f48c678cdaa36b5efee13472ff5
SHA256bb78ca0dd1478027e2e9f06f56fc7c3cc6f157b4151562d58a7f6646e463fcc2
SHA512d9801cdd8cc9809781b79882a226ee7a56d93eac0181295c80cb1f088f0fbf46e3eb35c7d8ff208dbd5a3e93a190a04c48fd254c9971a3740b020547973683e1
-
Filesize
67KB
MD5e994387279fec56a0eda4ca03eec759e
SHA1f3a3872b42c7c5bc3379a605dac398e8596e1179
SHA25601604c20b2ef42ed854c84c75a4227a844f543e54e1c05949281f9adabb762ff
SHA512f005e4916d0fb468c70946ca884cd38870a74dd8936ca49925e79cc0aa0458ca578b61e0be436aa2497e98c45f95513e14085289746f41027a2bfec540d3dc79
-
Filesize
764KB
MD5ad3f73c30a8cc258f6f62b46d6721a32
SHA10c7f53fb062dc30669660b8ab7fc59c0ba2be88f
SHA25612763f88b6573a9864d2aa2a232ada5d2eddeaccc4c225030a2efcf28ffc9888
SHA512bc265198eaccf9d164c1a8538173652887961e158c123c9b34fd9bd4584299027063217bb779a1d8e115e8e85bcd761d6a04b5b664fe1001cdbb45c717215f68
-
Filesize
1KB
MD542db3bf552d255d27dc69f2e9825d56d
SHA11328e72f3d0b327b3ef2e3316b0851f324ce1cda
SHA2566d09f699c9ef5ab1027cd5543cae2c2926e7f2dd92b5ab8919a6c9e706738415
SHA512899dd7fe1a9887f279db90657e7856830752ed2d697b40bfde7f31c68f0481e5dc2d502c46b95de9d11e5deb4bade6046647c7a5dc374bfc6e15334e92e92b8c
-
Filesize
3.6MB
MD586af9b888a72bdceb8fd8ed54975edd5
SHA1c9d67c9243f818c0a8cc279267cca44d9995f0cf
SHA256e11aa3893597d7c408349ebb11f47a24e388fd702c4d38b5d6f363f7ad6e8e5f
SHA5125d8fd9040f466e23af7f17772e3769ad83c5f55f8c70dcc3cfb1f827e105f0f4e6133f0e183fabc67dd44799495c47f931bf92546342b30b9c4a5c2b4aeee7c7
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
20KB
MD55e9b3e874f8fbeaadef3a004a1b291b5
SHA1b356286005efb4a3a46a1fdd53e4fcdc406569d0
SHA256f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
SHA512482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
23KB
MD5b900811a252be90c693e5e7ae365869d
SHA1345752c46f7e8e67dadef7f6fd514bed4b708fc5
SHA256bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a
SHA51236b8cdba61b9222f65b055c0c513801f3278a3851912215658bcf0ce10f80197c1f12a5ca3054d8604da005ce08da8dcd303b8544706b642140a49c4377dd6ce
-
Filesize
22KB
MD555e2db5dcf8d49f8cd5b7d64fea640c7
SHA18fdc28822b0cc08fa3569a14a8c96edca03bfbbd
SHA25647b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
SHA512824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5
-
Filesize
5KB
MD5e127196e9174b429cc09c040158f6aab
SHA1ff850f5d1bd8efc1a8cb765fe8221330f0c6c699
SHA256abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
SHA512c4b98ebc65e25df41e6b9a93e16e608cf309fa0ae712578ee4974d84f7f33bcf2a6ed7626e88a343350e13da0c5c1a88e24a87fcbd44f7da5983bb3ef036a162
-
Filesize
11KB
MD5f9ed2096eea0f998c6701db8309f95a6
SHA1bcdb4f7e3db3e2d78d25ed4e9231297465b45db8
SHA2566437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b
SHA512e4fb8f28dc72ea913f79cedf5776788a0310608236d6607adc441e7f3036d589fd2b31c446c187ef5827fd37dcaa26d9e94d802513e3bf3300e94dd939695b30
-
Filesize
1.4MB
MD5fdc8a5d96f9576bd70aa1cadc2f21748
SHA1bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA2561a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
SHA512816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
-
Filesize
363B
MD5a6448af2c8fafc9a4f42eaca6bf6ab2e
SHA10b295b46b6df906e89f40a907022068bc6219302
SHA256cd44ee7f76c37c0c522bd0cfca41c38cdeddc74392b2191a3af1a63d9d18888e
SHA5125b1a8ca5b09b7281de55460d21d5195c4ee086bebdc35fa561001181490669ffc67d261f99eaa900467fe97e980eb733c5ffbf9d8c541ede18992bf4a435c749
-
Filesize
22KB
MD53250ec5b2efe5bbe4d3ec271f94e5359
SHA16a0fe910041c8df4f3cdc19871813792e8cc4e4c
SHA256e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf
SHA512f8e403f3d59d44333bce2aa7917e6d8115bec0fe5ae9a1306f215018b05056467643b7aa228154ddced176072bc903dfb556cb2638f5c55c1285c376079e8fe3
-
Filesize
971KB
MD51eb17f650462eea820f4cd727d2d3ab1
SHA1688f59160589ffa293502bffcd5c0e62e1993903
SHA25624968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
SHA5124b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18