142482b54e8df90d91524768c5df2009899da7d011d6eff3082c9d4b26368a97

Submit
Reports

Overview

overview

Static

static

096bb2bde6...8f.exe

windows10-2004-x64

2decc47201...a2.exe

windows10-2004-x64

44f28cd6ea...7e.exe

windows10-2004-x64

82ad518318...3a.exe

windows10-2004-x64

92c50cd253...b9.exe

windows10-2004-x64

a58b5f2e81...39.exe

windows10-2004-x64

c531015ec0...86.exe

windows10-2004-x64

ca8b0ebbb3...0e.exe

windows10-2004-x64

d8fd9ad2f3...3b.exe

windows10-2004-x64

f241f35bb0...e5.exe

windows10-2004-x64

$APPDATA/c...56.dll

windows10-2004-x64

$APPDATA/c...om.dll

windows10-2004-x64

$APPDATA/c...er.dll

windows10-2004-x64

$APPDATA/c...or.dll

windows10-2004-x64

$APPDATA/c...es.dll

windows10-2004-x64

$APPDATA/c...ib.dll

windows10-2004-x64

$APPDATA/cl/_ssl.dll

windows10-2004-x64

$APPDATA/cl/bz2.dll

windows10-2004-x64

$APPDATA/cl/cl.exe

windows10-2004-x64

$APPDATA/cl/mklnk.cmd

windows10-2004-x64

$APPDATA/c...at.dll

windows10-2004-x64

$APPDATA/c...27.dll

windows10-2004-x64

$APPDATA/c...27.dll

windows10-2004-x64

$APPDATA/c...ve.cmd

windows10-2004-x64

$APPDATA/c...ct.dll

windows10-2004-x64

$APPDATA/cl/ui.exe

windows10-2004-x64

$APPDATA/c...ta.dll

windows10-2004-x64

$APPDATA/c...pi.dll

windows10-2004-x64

$APPDATA/c...dh.dll

windows10-2004-x64

$APPDATA/c...pe.dll

windows10-2004-x64

$APPDATA/c...et.dll

windows10-2004-x64

$PLUGINSDIR/INetC.dll

windows10-2004-x64

Analysis

max time kernel
415s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 15:28

Sharing

Copy URL

Twitter E-mail

Static task

static1

pyinstaller ransomware

4 signatures

Behavioral task

behavioral1

Sample

096bb2bde62238273995a3a4446818a4b6b7df00fadb7ea3d068d88ca8e2798f.exe

Resource

win10v2004-20240709-en

defense_evasion evasion execution impact ransomware spyware stealer

windows10-2004-x64

20 signatures

600 seconds

Behavioral task

behavioral2

Sample

2decc47201a1d43aeec5853c4c89b7273bfdd782fcc52106a3675944739998a2.exe

Resource

win10v2004-20240709-en

persistence ransomware spyware stealer

windows10-2004-x64

7 signatures

600 seconds

Behavioral task

behavioral3

Sample

44f28cd6ea894c05030ab913e2a0f1f1596b4aa7c551df9381f521cb88a92f7e.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

600 seconds

Behavioral task

behavioral4

Sample

82ad5183183a5fa7d9f2324c67b21bb7c97ed1dd46cfb7b63494a6b94f8b893a.exe

Resource

win10v2004-20240709-en

defense_evasion execution impact ransomware spyware stealer

windows10-2004-x64

12 signatures

600 seconds

Behavioral task

behavioral5

Sample

92c50cd253de42823a2e1a59f2551aa315ceb12b8f741820bdbc14b5ebe1dfb9.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral6

Sample

a58b5f2e8172be31e3d1fcc046d044bd862393f3d3e12922287bedf6f8c18e39.exe

Resource

win10v2004-20240709-en

mimikatz defense_evasion discovery evasion execution impact ransomware spyware stealer

windows10-2004-x64

16 signatures

600 seconds

Behavioral task

behavioral7

Sample

c531015ec09adf346131a375df9b9d04c90657fac9b80f2b1e269dae6186de86.exe

Resource

win10v2004-20240709-en

spyware stealer

windows10-2004-x64

7 signatures

600 seconds

Behavioral task

behavioral8

Sample

ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.exe

Resource

win10v2004-20240709-en

ransomware

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral9

Sample

d8fd9ad2f30cade8bf0c36f5a3acc64ccc95f625b9f3e2c0654046a531b4e83b.exe

Resource

win10v2004-20240709-en

gandcrab backdoor ransomware spyware stealer

windows10-2004-x64

14 signatures

600 seconds

Behavioral task

behavioral10

Sample

f241f35bb0f53a1baf0e5da26ef7bb86f3de83e94f3ccab04086b26f2f95dde5.exe

Resource

win10v2004-20240709-en

persistence

windows10-2004-x64

5 signatures

600 seconds

Behavioral task

behavioral11

Sample

$APPDATA/cl/Crypto.Hash._SHA256.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral12

Sample

$APPDATA/cl/Crypto.Random.OSRNG.winrandom.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral13

Sample

$APPDATA/cl/Crypto.Util._counter.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral14

Sample

$APPDATA/cl/Crypto.Util.strxor.dll

Resource

win10v2004-20240704-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral15

Sample

$APPDATA/cl/_ctypes.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral16

Sample

$APPDATA/cl/_hashlib.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral17

Sample

$APPDATA/cl/_ssl.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral18

Sample

$APPDATA/cl/bz2.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral19

Sample

$APPDATA/cl/cl.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

0 signatures

600 seconds

Behavioral task

behavioral20

Sample

$APPDATA/cl/mklnk.cmd

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral21

Sample

$APPDATA/cl/pyexpat.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral22

Sample

$APPDATA/cl/python27.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral23

Sample

$APPDATA/cl/pywintypes27.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral24

Sample

$APPDATA/cl/remove.cmd

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

600 seconds

Behavioral task

behavioral25

Sample

$APPDATA/cl/select.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral26

Sample

$APPDATA/cl/ui.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral27

Sample

$APPDATA/cl/unicodedata.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral28

Sample

$APPDATA/cl/win32api.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral29

Sample

$APPDATA/cl/win32pdh.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral30

Sample

$APPDATA/cl/win32pipe.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral31

Sample

$APPDATA/cl/win32wnet.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral32

Sample

$PLUGINSDIR/INetC.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Report Analysis Logs

General

Target

$APPDATA/cl/Crypto.Hash._SHA256.dll
Size

10KB
MD5

ff1572e32a186328a4c9772d6bf86801
SHA1

67a86ed4e19db016d308b1438fb7e9727b8dc0f2
SHA256

fd792cf966bc67177c9f37e95c23d8c4170756f6aac7dc80e9ebc6c808566921
SHA512

1c217f47edc1afbd59b05f15e57ab21813eec1c8a676beddfc192bff05ea53e1c737bec174bdcaed32b1222f01ceb8defe9059bca7ea52d52fbcc488e4381ad2
SSDEEP

192:eidzghojQKuGhNUyA5jQjT8KW6WZXN7cLmoVktRcYX3X62dqNea:9dzgwLkjjoT8KQXgVktRK2s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 5032	3188	rundll32.exe	84
PID 3188 wrote to memory of 5032	3188	rundll32.exe	84
PID 3188 wrote to memory of 5032	3188	rundll32.exe	84

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\Crypto.Hash._SHA256.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\Crypto.Hash._SHA256.dll,#1
  2⤵
  PID:5032

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads