2757fa3287b7c4ebbe244efdf36758c50f961226c4b35d61b8e9926f793a6a16

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PySilon-malware-3.7.5/python-3.12.4-amd64.exe
Size

25.5MB
MD5

f3df1be26cc7cbd8252ab5632b62d740
SHA1

3b1f54802b4cb8c02d1eb78fc79f95f91e8e49e4
SHA256

da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258
SHA512

2f9a11ffae6d9f1ed76bf816f28812fcba71f87080b0c92e52bfccb46243118c5803a7e25dd78003ca7d66501bfcdce8ff7c691c63c0038b0d409ca3842dcc89
SSDEEP

786432:zRd0l0X/46+nq1rcVqA5Z2bQcLsv0GlYrJF55e2nRk:L5P46+q1QTILMKB5e2nRk

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

python-3.12.4-amd64.exe

pid process

3548 python-3.12.4-amd64.exe
Loads dropped DLL 1 IoCs

Processes:

python-3.12.4-amd64.exe

pid process

3548 python-3.12.4-amd64.exe

pid	process
3548	python-3.12.4-amd64.exe

pid	process
3548	python-3.12.4-amd64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

python-3.12.4-amd64.exepython-3.12.4-amd64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.4-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.4-amd64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

python-3.12.4-amd64.exe

description	pid	process	target process
PID 1696 wrote to memory of 3548	1696	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 1696 wrote to memory of 3548	1696	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe
PID 1696 wrote to memory of 3548	1696	python-3.12.4-amd64.exe	python-3.12.4-amd64.exe

C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\python-3.12.4-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\python-3.12.4-amd64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\Temp\{C121A6D9-A531-4389-9060-7E1C27F2249E}\.cr\python-3.12.4-amd64.exe
"C:\Windows\Temp\{C121A6D9-A531-4389-9060-7E1C27F2249E}\.cr\python-3.12.4-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\PySilon-malware-3.7.5\python-3.12.4-amd64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=544
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{1E3588C8-D068-4426-8C57-8246FA8BC2FB}\.ba\PythonBA.dll

Filesize
675KB

MD5
e58bf4439057b22e6db8735be19d61ad

SHA1
415e148ecf78754a72de761d88825366aaf7afa1

SHA256
e3d3f38fd9a32720db3a65180857497d9064cffe0a54911c96b6138a17199058

SHA512
8d3523a12ee82123a17e73e507d42ae3248bd5c0aa697d5a379e61b965781bd83c0c97de41104b494b1f3b42127ab4b48ac9a071d5194a75c2af107016fc8c9c

Download Submit
C:\Windows\Temp\{1E3588C8-D068-4426-8C57-8246FA8BC2FB}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{C121A6D9-A531-4389-9060-7E1C27F2249E}\.cr\python-3.12.4-amd64.exe

Filesize
858KB

MD5
504fdaeaa19b2055ffc58d23f830e104

SHA1
7071c8189d1ecd09173111f9787888723040433f

SHA256
8f211f3b8af3a2e6fd4aff1ac27a1ad9cd9737524e016b2e3bfc689dfdad95fb

SHA512
01aa983cbddfe38e69f381e8f8e66988273ef453b095012f9c0eeae01d39e32deb0e6fb369363cbb5e387485be33a53ac3ec16d3de1f42bb2cde0cfa05ceb366

Download Submit