1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840

Analysis

max time kernel
131s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
Size

10.9MB
MD5

faf1270013c6935ae2edaf8e2c2b2c08
SHA1

d9a44759cd449608589b8f127619d422ccb40afa
SHA256

1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
SHA512

4a9ca18f796d4876effc5692cfeb7ce6d1cffdd2541b68753f416d2b0a7eff87588bc05793145a2882fc62a48512a862fa42826761022fed1696c20864c89098
SSDEEP

196608:I3pwZJjbyU3b01Kpn3V+uq+VvpqL2Vmd6+Dfc/f/+SveM0EVRuvEKn:uSZL01+l+uq+VvIL2Vmd6mfc/e03RMZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 20 IoCs

pid	Process
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5020	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3280	724	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	85
PID 724 wrote to memory of 3280	724	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	85
PID 3280 wrote to memory of 2196	3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	86
PID 3280 wrote to memory of 2196	3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	86
PID 3280 wrote to memory of 5020	3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	96
PID 3280 wrote to memory of 5020	3280	1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
"C:\Users\Admin\AppData\Local\Temp\1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe
  "C:\Users\Admin\AppData\Local\Temp\1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2196
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn MyTask /tr "\"C:\Users\Admin\AppData\Roaming\Suh\jre8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\Suh\client.jar\"" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI7242\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_brotli.cp310-win_amd64.pyd

Filesize
801KB

MD5
ee3d454883556a68920caaedefbc1f83

SHA1
45b4d62a6e7db022e52c6159eef17e9d58bec858

SHA256
791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1

SHA512
e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_bz2.pyd

Filesize
81KB

MD5
a4b636201605067b676cc43784ae5570

SHA1
e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

SHA256
f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

SHA512
02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_ctypes.pyd

Filesize
119KB

MD5
87596db63925dbfe4d5f0f36394d7ab0

SHA1
ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

SHA256
92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

SHA512
e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_hashlib.pyd

Filesize
60KB

MD5
49ce7a28e1c0eb65a9a583a6ba44fa3b

SHA1
dcfbee380e7d6c88128a807f381a831b6a752f10

SHA256
1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

SHA512
cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_lzma.pyd

Filesize
154KB

MD5
b5fbc034ad7c70a2ad1eb34d08b36cf8

SHA1
4efe3f21be36095673d949cceac928e11522b29c

SHA256
80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

SHA512
e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_pytransform.dll

Filesize
1.1MB

MD5
4a9d54d85df402bb7fea9f1c278ff5a4

SHA1
414ce62f8fef39a08cd9214296e3a4985ea2f5e6

SHA256
c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9

SHA512
8b5176cdeedc092282cd7963cf15e2348143de43d0bf0551e37071c2b5319c3aa214a2e2232d095f8f3e7c64e3475b3455fa593413ca8f1d04e8b133d4ef91ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_queue.pyd

Filesize
29KB

MD5
23f4becf6a1df36aee468bb0949ac2bc

SHA1
a0e027d79a281981f97343f2d0e7322b9fe9b441

SHA256
09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66

SHA512
3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_socket.pyd

Filesize
75KB

MD5
e137df498c120d6ac64ea1281bcab600

SHA1
b515e09868e9023d43991a05c113b2b662183cfe

SHA256
8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

SHA512
cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\_ssl.pyd

Filesize
155KB

MD5
35f66ad429cd636bcad858238c596828

SHA1
ad4534a266f77a9cdce7b97818531ce20364cb65

SHA256
58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

SHA512
1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\base_library.zip

Filesize
1.0MB

MD5
72d4e288992c783409b299f4fc842d39

SHA1
ba2ed3d465949d6a5e583286161cff01eca39258

SHA256
ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085

SHA512
bf7d46a3cf25f0b1569f9f81c1498cccecf9df8254ce597ff0031e484f228c61ce12329cb079276f3b319e99d0076214d6548524ec55cb2aa8ad83103d5badbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\libcrypto-1_1.dll

Filesize
3.3MB

MD5
ab01c808bed8164133e5279595437d3d

SHA1
0f512756a8db22576ec2e20cf0cafec7786fb12b

SHA256
9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

SHA512
4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\libssl-1_1.dll

Filesize
682KB

MD5
de72697933d7673279fb85fd48d1a4dd

SHA1
085fd4c6fb6d89ffcc9b2741947b74f0766fc383

SHA256
ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

SHA512
0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\python3.DLL

Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\select.pyd

Filesize
28KB

MD5
adc412384b7e1254d11e62e451def8e9

SHA1
04e6dff4a65234406b9bc9d9f2dcfe8e30481829

SHA256
68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

SHA512
f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\ucrtbase.dll

Filesize
964KB

MD5
cd7a487bb5ca20005a81402eee883569

SHA1
f427aaf18b53311a671e60b94bd897a904699d19

SHA256
f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7

SHA512
24da7a345429f2bc7a1b1e230f2d4400b8d57ecdf822d87d63fd4db0aed888b3ea3e98f8cb3f5b83986bfb846c1bd6eac2ac9382caba267c6ceca6ee77d79417

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7242\unicodedata.pyd

Filesize
1.1MB

MD5
102bbbb1f33ce7c007aac08fe0a1a97e

SHA1
9a8601bea3e7d4c2fa6394611611cda4fc76e219

SHA256
2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758

SHA512
a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

Download Submit
memory/3280-121-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-101-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-133-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-131-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-129-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-125-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-123-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-137-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-119-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-117-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-115-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-113-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-111-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-109-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-107-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-105-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-103-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-135-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-99-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-97-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-95-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-93-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-91-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-90-0x0000026E908F0000-0x0000026E908F1000-memory.dmp

Filesize
4KB

Download
memory/3280-139-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-143-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-145-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-147-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-149-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-151-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-153-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-141-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download
memory/3280-127-0x0000026E90900000-0x0000026E90901000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads