Analysis

  • max time kernel
    32s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 13:26

General

  • Target

    Cwelium.exe

  • Size

    12.8MB

  • MD5

    115f9b45652050c331772c23c3d9052b

  • SHA1

    02344573f43aa8c86c071a70a9d2f0f192f1d285

  • SHA256

    77521e5cd2ee27a5bf92da529ec68cafc92cb18bc121acb8ae9056f32fcc93b6

  • SHA512

    e3a08e03a6b5c9e26ad4255a528a0e780aa19972b07e4c8362c425483eeab442b18c76a07d837c8081a3adcbe6f52bcbf5ae5fb01e18314108357cf17cad738f

  • SSDEEP

    393216:L0ZYk5yBDB3PYooP6j7ft6kMCLpb7nmbn7WEIgV8:LnpBDB3JoP6MYJ6bnAA

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 20 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
    "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\Cwelium.exe
      "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:3148
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c title Cwelium
          3⤵
            PID:2984
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:3900
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c title Cwelium - Connected as Admin - made by Tips-Discord
              3⤵
                PID:924
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                3⤵
                  PID:544
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c title Cwelium - Connected as Admin - made by Tips-Discord
                  3⤵
                    PID:1568
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c title Cwelium - Checker
                    3⤵
                      PID:2024
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c cls
                      3⤵
                        PID:1436
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c cls
                        3⤵
                          PID:4012
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c title Cwelium - Connected as Admin - made by Tips-Discord
                          3⤵
                            PID:2308
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c cls
                            3⤵
                              PID:4344
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c title Cwelium - Connected as Admin - made by Tips-Discord
                              3⤵
                                PID:4692

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

                            Filesize

                            82KB

                            MD5

                            3859239ced9a45399b967ebce5a6ba23

                            SHA1

                            6f8ff3df90ac833c1eb69208db462cda8ca3f8d6

                            SHA256

                            a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a

                            SHA512

                            030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

                            Filesize

                            120KB

                            MD5

                            bd36f7d64660d120c6fb98c8f536d369

                            SHA1

                            6829c9ce6091cb2b085eb3d5469337ac4782f927

                            SHA256

                            ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

                            SHA512

                            bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

                            Filesize

                            63KB

                            MD5

                            4255c44dc64f11f32c961bf275aab3a2

                            SHA1

                            c1631b2821a7e8a1783ecfe9a14db453be54c30a

                            SHA256

                            e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29

                            SHA512

                            7d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

                            Filesize

                            157KB

                            MD5

                            208b0108172e59542260934a2e7cfa85

                            SHA1

                            1d7ffb1b1754b97448eb41e686c0c79194d2ab3a

                            SHA256

                            5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69

                            SHA512

                            41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_uuid.pyd

                            Filesize

                            24KB

                            MD5

                            46e9d7b5d9668c9db5caa48782ca71ba

                            SHA1

                            6bbc83a542053991b57f431dd377940418848131

                            SHA256

                            f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735

                            SHA512

                            c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

                            Filesize

                            287KB

                            MD5

                            2a6bef11d1f4672f86d3321b38f81220

                            SHA1

                            b4146c66e7e24312882d33b16b2ee140cb764b0e

                            SHA256

                            1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c

                            SHA512

                            500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

                            Filesize

                            688KB

                            MD5

                            25bde25d332383d1228b2e66a4cb9f3e

                            SHA1

                            cd5b9c3dd6aab470d445e3956708a324e93a9160

                            SHA256

                            c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13

                            SHA512

                            ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll

                            Filesize

                            17.8MB

                            MD5

                            181458ffd109573a1cde903e187b0b46

                            SHA1

                            6822c8b9cad8f13f3c0921205ada08efd693d93e

                            SHA256

                            b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87

                            SHA512

                            0f771e01e5f89dd83a8e46d129a7975b6ca395369d82411c9864805f1efa9ab7051e6caa24a5fad121391a25cb84dc991845da976265f3d67f8528aa01a280a8

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd

                            Filesize

                            512KB

                            MD5

                            dc08f04c9e03452764b4e228fc38c60b

                            SHA1

                            317bcc3f9c81e2fc81c86d5a24c59269a77e3824

                            SHA256

                            b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

                            SHA512

                            fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\Cwelium.exe

                            Filesize

                            15.0MB

                            MD5

                            765f529f47e6bcefc2165d5f26704845

                            SHA1

                            51d6c8d4061572f79b78af44bab1a5468442c6f5

                            SHA256

                            d4657cb84910fc0b479dab7b098722b3dffb26d64dfd72a9a3de5b833e752d1f

                            SHA512

                            6d0a6f4dac6dab171122004c477bd6d11e0eff5b0c9beb7643724322362d498fc4b52b9f08ba35b0c08ac272ac214de4e4f9f71e6df275f1e0240b2d8671f288

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\VCRUNTIME140.dll

                            Filesize

                            106KB

                            MD5

                            4585a96cc4eef6aafd5e27ea09147dc6

                            SHA1

                            489cfff1b19abbec98fda26ac8958005e88dd0cb

                            SHA256

                            a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                            SHA512

                            d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\_lzma.pyd

                            Filesize

                            155KB

                            MD5

                            e5abc3a72996f8fde0bcf709e6577d9d

                            SHA1

                            15770bdcd06e171f0b868c803b8cf33a8581edd3

                            SHA256

                            1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb

                            SHA512

                            b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\_queue.pyd

                            Filesize

                            31KB

                            MD5

                            f00133f7758627a15f2d98c034cf1657

                            SHA1

                            2f5f54eda4634052f5be24c560154af6647eee05

                            SHA256

                            35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659

                            SHA512

                            1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\_socket.pyd

                            Filesize

                            77KB

                            MD5

                            1eea9568d6fdef29b9963783827f5867

                            SHA1

                            a17760365094966220661ad87e57efe09cd85b84

                            SHA256

                            74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

                            SHA512

                            d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\charset_normalizer\md.pyd

                            Filesize

                            10KB

                            MD5

                            723ec2e1404ae1047c3ef860b9840c29

                            SHA1

                            8fc869b92863fb6d2758019dd01edbef2a9a100a

                            SHA256

                            790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

                            SHA512

                            2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\charset_normalizer\md__mypyc.pyd

                            Filesize

                            116KB

                            MD5

                            9ea8098d31adb0f9d928759bdca39819

                            SHA1

                            e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

                            SHA256

                            3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

                            SHA512

                            86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\libcrypto-1_1.dll

                            Filesize

                            3.3MB

                            MD5

                            e94733523bcd9a1fb6ac47e10a267287

                            SHA1

                            94033b405386d04c75ffe6a424b9814b75c608ac

                            SHA256

                            f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44

                            SHA512

                            07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\libffi-8.dll

                            Filesize

                            38KB

                            MD5

                            0f8e4992ca92baaf54cc0b43aaccce21

                            SHA1

                            c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                            SHA256

                            eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                            SHA512

                            6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\python311.dll

                            Filesize

                            5.5MB

                            MD5

                            5a5dd7cad8028097842b0afef45bfbcf

                            SHA1

                            e247a2e460687c607253949c52ae2801ff35dc4a

                            SHA256

                            a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

                            SHA512

                            e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\select.pyd

                            Filesize

                            29KB

                            MD5

                            c97a587e19227d03a85e90a04d7937f6

                            SHA1

                            463703cf1cac4e2297b442654fc6169b70cfb9bf

                            SHA256

                            c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

                            SHA512

                            97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

                          • C:\Users\Admin\AppData\Local\Temp\onefile_4000_133663876465080586\unicodedata.pyd

                            Filesize

                            1.1MB

                            MD5

                            aa13ee6770452af73828b55af5cd1a32

                            SHA1

                            c01ece61c7623e36a834d8b3c660e7f28c91177e

                            SHA256

                            8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb

                            SHA512

                            b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f

                          • memory/1148-70-0x00007FF61FCF0000-0x00007FF620C27000-memory.dmp

                            Filesize

                            15.2MB

                          • memory/1148-71-0x00007FFCB3AC0000-0x00007FFCB4C4F000-memory.dmp

                            Filesize

                            17.6MB

                          • memory/1148-76-0x00007FF61FCF0000-0x00007FF620C27000-memory.dmp

                            Filesize

                            15.2MB

                          • memory/4000-69-0x00007FF704890000-0x00007FF705573000-memory.dmp

                            Filesize

                            12.9MB