142482b54e8df90d91524768c5df2009899da7d011d6eff3082c9d4b26368a97

Submit
Reports

Overview

overview

Static

static

096bb2bde6...8f.exe

windows10-2004-x64

2decc47201...a2.exe

windows10-2004-x64

44f28cd6ea...7e.exe

windows10-2004-x64

82ad518318...3a.exe

windows10-2004-x64

92c50cd253...b9.exe

windows10-2004-x64

a58b5f2e81...39.exe

windows10-2004-x64

c531015ec0...86.exe

windows10-2004-x64

ca8b0ebbb3...0e.exe

windows10-2004-x64

d8fd9ad2f3...3b.exe

windows10-2004-x64

f241f35bb0...e5.exe

windows10-2004-x64

$APPDATA/c...56.dll

windows10-2004-x64

$APPDATA/c...om.dll

windows10-2004-x64

$APPDATA/c...er.dll

windows10-2004-x64

$APPDATA/c...or.dll

windows10-2004-x64

$APPDATA/c...es.dll

windows10-2004-x64

$APPDATA/c...ib.dll

windows10-2004-x64

$APPDATA/cl/_ssl.dll

windows10-2004-x64

$APPDATA/cl/bz2.dll

windows10-2004-x64

$APPDATA/cl/cl.exe

windows10-2004-x64

$APPDATA/cl/mklnk.cmd

windows10-2004-x64

$APPDATA/c...at.dll

windows10-2004-x64

$APPDATA/c...27.dll

windows10-2004-x64

$APPDATA/c...27.dll

windows10-2004-x64

$APPDATA/c...ve.cmd

windows10-2004-x64

$APPDATA/c...ct.dll

windows10-2004-x64

$APPDATA/cl/ui.exe

windows10-2004-x64

$APPDATA/c...ta.dll

windows10-2004-x64

$APPDATA/c...pi.dll

windows10-2004-x64

$APPDATA/c...dh.dll

windows10-2004-x64

$APPDATA/c...pe.dll

windows10-2004-x64

$APPDATA/c...et.dll

windows10-2004-x64

$PLUGINSDIR/INetC.dll

windows10-2004-x64

Analysis

max time kernel
548s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 15:28

Sharing

Copy URL

Twitter E-mail

Static task

static1

pyinstaller ransomware

4 signatures

Behavioral task

behavioral1

Sample

096bb2bde62238273995a3a4446818a4b6b7df00fadb7ea3d068d88ca8e2798f.exe

Resource

win10v2004-20240709-en

defense_evasion evasion execution impact ransomware spyware stealer

windows10-2004-x64

20 signatures

600 seconds

Behavioral task

behavioral2

Sample

2decc47201a1d43aeec5853c4c89b7273bfdd782fcc52106a3675944739998a2.exe

Resource

win10v2004-20240709-en

persistence ransomware spyware stealer

windows10-2004-x64

7 signatures

600 seconds

Behavioral task

behavioral3

Sample

44f28cd6ea894c05030ab913e2a0f1f1596b4aa7c551df9381f521cb88a92f7e.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

600 seconds

Behavioral task

behavioral4

Sample

82ad5183183a5fa7d9f2324c67b21bb7c97ed1dd46cfb7b63494a6b94f8b893a.exe

Resource

win10v2004-20240709-en

defense_evasion execution impact ransomware spyware stealer

windows10-2004-x64

12 signatures

600 seconds

Behavioral task

behavioral5

Sample

92c50cd253de42823a2e1a59f2551aa315ceb12b8f741820bdbc14b5ebe1dfb9.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral6

Sample

a58b5f2e8172be31e3d1fcc046d044bd862393f3d3e12922287bedf6f8c18e39.exe

Resource

win10v2004-20240709-en

mimikatz defense_evasion discovery evasion execution impact ransomware spyware stealer

windows10-2004-x64

16 signatures

600 seconds

Behavioral task

behavioral7

Sample

c531015ec09adf346131a375df9b9d04c90657fac9b80f2b1e269dae6186de86.exe

Resource

win10v2004-20240709-en

spyware stealer

windows10-2004-x64

7 signatures

600 seconds

Behavioral task

behavioral8

Sample

ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.exe

Resource

win10v2004-20240709-en

ransomware

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral9

Sample

d8fd9ad2f30cade8bf0c36f5a3acc64ccc95f625b9f3e2c0654046a531b4e83b.exe

Resource

win10v2004-20240709-en

gandcrab backdoor ransomware spyware stealer

windows10-2004-x64

14 signatures

600 seconds

Behavioral task

behavioral10

Sample

f241f35bb0f53a1baf0e5da26ef7bb86f3de83e94f3ccab04086b26f2f95dde5.exe

Resource

win10v2004-20240709-en

persistence

windows10-2004-x64

5 signatures

600 seconds

Behavioral task

behavioral11

Sample

$APPDATA/cl/Crypto.Hash._SHA256.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral12

Sample

$APPDATA/cl/Crypto.Random.OSRNG.winrandom.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral13

Sample

$APPDATA/cl/Crypto.Util._counter.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral14

Sample

$APPDATA/cl/Crypto.Util.strxor.dll

Resource

win10v2004-20240704-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral15

Sample

$APPDATA/cl/_ctypes.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral16

Sample

$APPDATA/cl/_hashlib.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral17

Sample

$APPDATA/cl/_ssl.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral18

Sample

$APPDATA/cl/bz2.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral19

Sample

$APPDATA/cl/cl.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

0 signatures

600 seconds

Behavioral task

behavioral20

Sample

$APPDATA/cl/mklnk.cmd

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral21

Sample

$APPDATA/cl/pyexpat.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral22

Sample

$APPDATA/cl/python27.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral23

Sample

$APPDATA/cl/pywintypes27.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral24

Sample

$APPDATA/cl/remove.cmd

Resource

win10v2004-20240709-en

windows10-2004-x64

3 signatures

600 seconds

Behavioral task

behavioral25

Sample

$APPDATA/cl/select.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral26

Sample

$APPDATA/cl/ui.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Behavioral task

behavioral27

Sample

$APPDATA/cl/unicodedata.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral28

Sample

$APPDATA/cl/win32api.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral29

Sample

$APPDATA/cl/win32pdh.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral30

Sample

$APPDATA/cl/win32pipe.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral31

Sample

$APPDATA/cl/win32wnet.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

600 seconds

Behavioral task

behavioral32

Sample

$PLUGINSDIR/INetC.dll

Resource

win10v2004-20240709-en

windows10-2004-x64

2 signatures

600 seconds

Report Analysis Logs

General

Target

$APPDATA/cl/win32wnet.dll
Size

24KB
MD5

10f5aa748130774c89b7274c8d9b83e3
SHA1

f195d87517bb0a6e6cbca9f4302dc100f9a5aa36
SHA256

fcfd8d0d6a8e905b31ccf5a9dc00366ae2a436072eeff4378bd4fc14ce7ac267
SHA512

e07676f40d284bd4a00f132f77419064bb5137674428fac61c6d6cee33545b8ebd72a50bdd0c907f408494962359d3065085f05d1dae8baf850dadb2a261cbb1
SSDEEP

768:eRZ5g+l3KQZrpJI/fm2Jj4cgANOtr85OELxV262R:eRZ5g+l3KQZrpefm2Jj4cgANOtCLxV25

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 400	2664	rundll32.exe	84
PID 2664 wrote to memory of 400	2664	rundll32.exe	84
PID 2664 wrote to memory of 400	2664	rundll32.exe	84

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\win32wnet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\win32wnet.dll,#1
  2⤵
  PID:400

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads