Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-07-2024 16:49

General

  • Target

    V3NOMFINALREDO.exe

  • Size

    42.1MB

  • MD5

    a13a991baa860c7f565f49c52df9cee9

  • SHA1

    57a283899380711e3f680b579f0ebe08977f594f

  • SHA256

    dbe6751c0bcb80da8c48b8099ae41d726a3f6c378e1db723393b91e8f2b4d347

  • SHA512

    e8f1b96711a688177df6a8d150c0e623fd17fb396e69eb4483dade15bf56cb12a948544a8dd4b856e405a472a2821809cd8e70dd089f0bd46976c355cfcc0312

  • SSDEEP

    786432:ucPdbuzcY876JmeIi6/9x9ta9eyq8OThzvcdpJ0q8TPZUd3GfS49trYB7Q/sAYd0:ucPdiE7MdIiYweyJulZUdgjt/Z9U

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\V3NOMFINALREDO.exe
    "C:\Users\Admin\AppData\Local\Temp\V3NOMFINALREDO.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\V3NOMFINALREDO.exe
      "C:\Users\Admin\AppData\Local\Temp\V3NOMFINALREDO.exe"
      2⤵
      • Loads dropped DLL
      PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140.dll

    Filesize

    116KB

    MD5

    be8dbe2dc77ebe7f88f910c61aec691a

    SHA1

    a19f08bb2b1c1de5bb61daf9f2304531321e0e40

    SHA256

    4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

    SHA512

    0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140_1.dll

    Filesize

    48KB

    MD5

    f8dfa78045620cf8a732e67d1b1eb53d

    SHA1

    ff9a604d8c99405bfdbbf4295825d3fcbc792704

    SHA256

    a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

    SHA512

    ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_asyncio.pyd

    Filesize

    37KB

    MD5

    6880e3d5872fefa9810753e181cf3033

    SHA1

    e875467792bbe3c4117040f6cf935a7a60a21d55

    SHA256

    c7000207e8c406f3a18b006649248906963834ff901c7b8b9f627d534e31575b

    SHA512

    f501bfe8300b20a621d587d9a86e1228ab90da5f4cab8ed47a2822617ca5eeaf66691756228745ff24084ba481f6b3eedcddfc4a4869cd56334e8ca53a92148d

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_bz2.pyd

    Filesize

    48KB

    MD5

    ab542da47a7745a2f588ca78d41734e0

    SHA1

    d8f1601548510333e35199e3b6bb4eaf994ca9ae

    SHA256

    4aba601dd528a85dad5975daf6aa394002c8a38582e4abb05a89684f52130084

    SHA512

    d80228ae846c562e08b08b92796e871e546760cd8ed92cbbe526675947ea2a5524ff4a93210e820c9f646912db24ff112ed2a354fc018a53a5161934c7fbd0f0

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_ctypes.pyd

    Filesize

    59KB

    MD5

    fc609234e81821c069d54a7c8d4a7e05

    SHA1

    9aef96aa0276feb2df28ce0abf4ec1f2f766d011

    SHA256

    506cdca8f4cc4754a78edac3be230a5ec7ca4a0d61ef08fe0accab4080b2c69e

    SHA512

    bea687c1a9ed32db6c99be1c8689ac9e498f0ffce74c0c66c6c7653d58b6ee90e50df66c8a48b49854d47142fa9a930047f4828651193f7a500ae7fbc1882d2e

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_decimal.pyd

    Filesize

    107KB

    MD5

    e3245ba10c125de02593c0a67669ab17

    SHA1

    6b846b98ee8f663aa39d3c6c960df8bc84d82193

    SHA256

    306cc1df8631d632e9831d6a710c8776784c4655b107424290338c385e743026

    SHA512

    26c4d7280a93dc004b0a92689c43b9bcb6c0afa282d24581051fd18d0037499c2c77431636ca20a9225af002f254526cf66ff466b3b7fad0d73b8096ce1594fc

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_hashlib.pyd

    Filesize

    35KB

    MD5

    fa6ae459e8a2c3071bd373da5a4cfe18

    SHA1

    dbf6462e952efe70f4ad72c0c8688456833462d5

    SHA256

    20af24170652420bc06adbb2fc159ae9e61e71f2cad5370b423c9ce4c57ad5e1

    SHA512

    9846f7fcf86fd67b03080a6ec270e4c6ecb0fee7bd0019fddd976c26e062c5d41f35691384a2307ca80289010f73cecf7326d7f446971639698b2948c4f67c08

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_lzma.pyd

    Filesize

    86KB

    MD5

    ed15089e3c0c1b2ab5b73354abf0087b

    SHA1

    f51ade203d249e27ebf9ae2159220fabdb8726c0

    SHA256

    02fe60ad99452d53294514e8c6b8d95d79cc013742e3a4cd74b36601fc3fb09b

    SHA512

    a9f869b2988057c37d14ee56495ecbf2ec688517203a7e2d1bc1488f4d37c6e3d3fb6fb439442c86679a9cebbbd5b2e7b11d42f64bdbce7212b6411cd27073ac

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_multiprocessing.pyd

    Filesize

    27KB

    MD5

    a2de86f88aad5c050f86d258b1f05617

    SHA1

    11824bbb09e5ee9865cadcbbfda1e0664c6d98ff

    SHA256

    f10fc80b19740eceb7fdce89c30d6670c9af7ed600fa7f881d27b8b5a054495f

    SHA512

    3662a8e6afa6b385a3e2682a49b0ae57f0f2aefc029eaaf841a228ec76c0f79c4e963b6f22eb345f4cad72b35bd72576a79a282d9816cf9b37b762773c10a80b

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_overlapped.pyd

    Filesize

    33KB

    MD5

    d2b3134bae2e401e1753aac8b9ca577e

    SHA1

    3b4c4fe61c724a6bc4ee423ee7a1efb007a1f515

    SHA256

    2386cf6ceaef4c6aa13974f913d6b3e6cde3b48e2fbb73f5c63ae6fe4384836f

    SHA512

    215609827121d9da6fa0bc884bd388391c46a799c22d54762775d591d9ae5e6bbce70011bc5f5237b6e526b79416c00f5daa8fc6baf70450ce37ced17fafa1f6

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_queue.pyd

    Filesize

    26KB

    MD5

    6cff25f6eb2872a07d52591cffe97ed7

    SHA1

    1e51fc338bcf4e868a827c8dd2d3573a60ec9a73

    SHA256

    b58694a5585645827ce1f0aa285e176e9328584917a36434132fd71c3f017d8d

    SHA512

    e847437f88dfd473272ed89f06fc9939c2e58e71f309275afa89599b4d79365459f763815660499be69b93b2440f3ed0dec88192d7d5b2be6ac2b79009a6442a

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_socket.pyd

    Filesize

    44KB

    MD5

    552d390e9c359bf460b87cfb9a24a48b

    SHA1

    d4920c3355b18087e9a392bea152cef90cc04a60

    SHA256

    f11b57f08a31e172cabae66830f9ef936e322a4df03ba5230d1621db4e7a24b6

    SHA512

    cfc59e43ab855f1c571db92c0df1258e88bc6db9d8569c2a5242b90d22f327503f4b4402f79f816f53f12a43f3d1ca84066231f0a3e719758340813f79528d8e

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_sqlite3.pyd

    Filesize

    57KB

    MD5

    435b49a7f84e7fbe0c6681932de37179

    SHA1

    a8a285579de10dacbfd053735c6f0ab930fe0fe2

    SHA256

    5321e5c26a9bcaebb58f11241121bd0d1e45f98dcfbb4d8457eae42f17b8328a

    SHA512

    13d7d7120a7a150d789b92964acbe6d2ea7ebb130d6cb1833456ea1cdd6654cdd1d8841165296b3f077935dbaec4a37ca7e45c395c0b72d9b6dc970dbb76136a

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_ssl.pyd

    Filesize

    66KB

    MD5

    318cfedf19856dbbc627e79ed9fd2b9c

    SHA1

    fb9b5565a033a8c6a4aee3f0a27de047714442d1

    SHA256

    efa7fef1f1456e19c44a787b62d047f5d73c6abb6a6d4201d125dc3d101fff09

    SHA512

    d5d616400fa33751bec6ce8786d4c29e6307f2042db0602907354734ff72387570201420290f5e99c375059ef7217159e254c44291b36f7f296574f506211e10

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\_wmi.pyd

    Filesize

    28KB

    MD5

    54ba74f0c557b0c0463c08b5d2439379

    SHA1

    8aa3f3f50501962f4a64ead15b24b6a77b06c5c5

    SHA256

    53d4c23bc2ba89ee5050bae9b498eebbcde5a1906e51389742780f0c976b861f

    SHA512

    fa4b6ca32a635f3a17d1e50b2b0a0c9e184cc104c2632b1d57c2a14db30272e6985a5665c567f49a5d4a6f36bfe80db9b5c591856d1667c024631a7050efb5fe

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\base_library.zip

    Filesize

    1.3MB

    MD5

    55df3c98d18ec80bc37a6682ba0abcbb

    SHA1

    e3bf60cfecfee2473d4e0b07057af3c27afa6567

    SHA256

    d8de678c0ac0cecb7be261bda75511c47e6a565f0c6260eacf240c7c5039753b

    SHA512

    26368c9187155ee83c450bfc792938a2908c473ba60330ce95bcc3f780390043879bbff3949bd4a25b38343eac3c5c9ba709267959109c9c99a229809c97f3bd

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\crypto_clipper.json

    Filesize

    155B

    MD5

    8bff94a9573315a9d1820d9bb710d97f

    SHA1

    e69a43d343794524b771d0a07fd4cb263e5464d5

    SHA256

    3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7

    SHA512

    d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\libcrypto-3.dll

    Filesize

    1.6MB

    MD5

    63eb76eccfe70cff3a3935c0f7e8ba0f

    SHA1

    a8dd05dce28b79047e18633aee5f7e68b2f89a36

    SHA256

    785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

    SHA512

    8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\libffi-8.dll

    Filesize

    29KB

    MD5

    be8ceb4f7cb0782322f0eb52bc217797

    SHA1

    280a7cc8d297697f7f818e4274a7edd3b53f1e4d

    SHA256

    7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

    SHA512

    07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\libopus-0.x64.dll

    Filesize

    217KB

    MD5

    e56f1b8c782d39fd19b5c9ade735b51b

    SHA1

    3d1dc7e70a655ba9058958a17efabe76953a00b4

    SHA256

    fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732

    SHA512

    b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\libssl-3.dll

    Filesize

    222KB

    MD5

    7e87c34b39f3a8c332df6e15fd83160b

    SHA1

    db712b55f23d8e946c2d91cbbeb7c9a78a92b484

    SHA256

    41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

    SHA512

    eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\pyexpat.pyd

    Filesize

    88KB

    MD5

    7291100352b163626455abf2252f2a96

    SHA1

    3c4d13bbf5fb69fe6f2af70f675ed2e437cea893

    SHA256

    01974148486d569e9f1ad62d36d4d54b5396b07c853bd50f358d5580fde331f4

    SHA512

    fc384703828bb7a38b51dcf1a131b49283808b5658395e1d1c5ee9a204f895da0c29b12a7b1fc9aa468babc5d6f03be638fecf519e41911bf015a481f95458bc

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\python312.dll

    Filesize

    1.7MB

    MD5

    8f165bfadf970edafd59067ad45a3952

    SHA1

    16c1876f2233087156b49db35d4d935c6e17be6a

    SHA256

    22470af77229d53d9141823c12780db63c43703dd525940bc479730d2e43513d

    SHA512

    b3af95dc9a68e21e8eca98e451b935f72663c2552ebf26de299716f17193f238d55c292df953d641defcbcec3ea18eb37cd4b839800804efa8f40658427263ae

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\select.pyd

    Filesize

    25KB

    MD5

    3b214dfb6ec4ca67be55b3aa52922827

    SHA1

    f665ffeab25d2bab506b873be944280586eb50f6

    SHA256

    7507a92c4787e9e7936a0b4a8eeb0a3f24e5ee12ae58cd7988543581d99817ac

    SHA512

    de4e9b9d79b01d21aca74179c6a3e8fc6fe041f71cdd78910fd893cda90c2cfe7e54ade91064333f37ffc880d446879a64dd8bb790677039df56df1f80ec6b45

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\sqlite3.dll

    Filesize

    644KB

    MD5

    b26fa7619d82c7272b7279eb7aae801c

    SHA1

    fa6a3240a531615a0853306f3b3d66aed98a04d8

    SHA256

    74dc76a2a2d06d61f9f06bd3b0972bfb30ab57b0e5cb8c3011e79ce4a52924f0

    SHA512

    20b0d6cf3e07ca0d565f140c9f9c1e218406ed9bdaaf75433858acb250bfb71bb134a6479fdcf6d4d0e0252707b1fb14f9c9d3e4d6a40824c3fdc7a43dfad0ee

  • C:\Users\Admin\AppData\Local\Temp\_MEI31002\unicodedata.pyd

    Filesize

    295KB

    MD5

    97f08bbcf9903c768668b1cd1e30aada

    SHA1

    84e2dc5c3662bd39ac09b5f682a59104ffec16d2

    SHA256

    c5c2997c3b16eb8b89fe230582a579a753efc8317ffd95d9795ec2762aa54ed9

    SHA512

    076ca0017ae252d62d4a3bd7a42af95800e39a164bda990a0ca651aa2f0df2736c0dfdc086d8328a1834ae89f17716c5f76e798460a90263d1d8b6f2c233c686

  • memory/4944-177-0x00007FF9E4390000-0x00007FF9E43B5000-memory.dmp

    Filesize

    148KB

  • memory/4944-178-0x00007FF9E73A0000-0x00007FF9E73AF000-memory.dmp

    Filesize

    60KB

  • memory/4944-150-0x00007FF9CE840000-0x00007FF9CEF04000-memory.dmp

    Filesize

    6.8MB

  • memory/4944-180-0x00007FF9E42B0000-0x00007FF9E42C4000-memory.dmp

    Filesize

    80KB

  • memory/4944-182-0x00007FF9CDFE0000-0x00007FF9CE509000-memory.dmp

    Filesize

    5.2MB

  • memory/4944-186-0x00007FF9E42B0000-0x00007FF9E42C4000-memory.dmp

    Filesize

    80KB

  • memory/4944-183-0x00007FF9CE840000-0x00007FF9CEF04000-memory.dmp

    Filesize

    6.8MB

  • memory/4944-187-0x00007FF9CDFE0000-0x00007FF9CE509000-memory.dmp

    Filesize

    5.2MB