Overview
overview
10Static
static
101K SOCKS5 HQ.txt.exe
windows10-2004-x64
9Priv8 Grab...v8.exe
windows10-2004-x64
7Project1.exe
windows10-2004-x64
3VExploit 7.5.exe
windows10-2004-x64
9autotiktok.exe
windows10-2004-x64
9carding software.exe
windows10-2004-x64
10cc.exe
windows10-2004-x64
10dom2ip.exe
windows10-2004-x64
7dungbulon_gnp..exe
windows10-2004-x64
10flashSO (3).exe
windows10-2004-x64
8game_12.exe
windows10-2004-x64
8mass_exploit_wp.exe
windows10-2004-x64
9revolve.co...g!.exe
windows10-2004-x64
9suckmydick.exe
windows10-2004-x64
10wallet_min...1).exe
windows10-2004-x64
8xReverseFreeV2.exe
windows10-2004-x64
7xReverseTrial.exe
windows10-2004-x64
7Analysis
- max time kernel
29s - max time network
34s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
10/08/2024, 09:47
Behavioral task
behavioral1
Sample
1K SOCKS5 HQ.txt.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
30 seconds
Behavioral task
behavioral2
Sample
Priv8 Grabber by vexelvoxpriv8.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
30 seconds
Behavioral task
behavioral3
Sample
Project1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
30 seconds
Behavioral task
behavioral4
Sample
VExploit 7.5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
30 seconds
Behavioral task
behavioral5
Sample
autotiktok.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
30 seconds
Behavioral task
behavioral6
Sample
carding software.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
30 seconds
Behavioral task
behavioral7
Sample
cc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
30 seconds
Behavioral task
behavioral8
Sample
dom2ip.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
30 seconds
Behavioral task
behavioral9
Sample
dungbulon_gnp..exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
30 seconds
Behavioral task
behavioral10
Sample
flashSO (3).exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
30 seconds
Behavioral task
behavioral11
Sample
game_12.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
30 seconds
Behavioral task
behavioral12
Sample
mass_exploit_wp.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
30 seconds
Behavioral task
behavioral13
Sample
revolve.com !Pro Cracking!.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
30 seconds
Behavioral task
behavioral14
Sample
suckmydick.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
30 seconds
Behavioral task
behavioral15
Sample
wallet_miner_v3.1 (1).exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
30 seconds
Behavioral task
behavioral16
Sample
xReverseFreeV2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
30 seconds
Behavioral task
behavioral17
Sample
xReverseTrial.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
30 seconds
General
- Target Priv8 Grabber by vexelvoxpriv8.exe
- Size 10.2MB
- Sample240810-lsn2yayeng
- SHA256 b7413294c2b3f39d38a6a016719e009dd90a9bb6ba98f2a13fc0e54bae18e9a0
- MD5 945a919fff30b168e5147244e23b1bb4
- SHA1 2bc2bd7242dfa94fea0ddaa8721aea982efbf203
- SHA512 3dc247e069a9b558df1d16330408bb7685a6c294e0ddda4ac45b3d82660a2a9af29e3491a86647d441f37de1a6a0c07d7cd66c5efcef656efa3ab81412c85e74
- SSDEEP 196608:wrt2JqS7B2DONbU2pHOLfK4FMIZETSejPePdrQJ/BNOqioH0vYPv1:tJz7B2D4RqKQETSevJHOqGvi1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 19 IoCs
pid Process 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe 3164 Priv8 Grabber by vexelvoxpriv8.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3332 wrote to memory of 3164 3332 Priv8 Grabber by vexelvoxpriv8.exe 86 PID 3332 wrote to memory of 3164 3332 Priv8 Grabber by vexelvoxpriv8.exe 86 PID 3164 wrote to memory of 4404 3164 Priv8 Grabber by vexelvoxpriv8.exe 87 PID 3164 wrote to memory of 4404 3164 Priv8 Grabber by vexelvoxpriv8.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Priv8 Grabber by vexelvoxpriv8.exe"C:\Users\Admin\AppData\Local\Temp\Priv8 Grabber by vexelvoxpriv8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\Priv8 Grabber by vexelvoxpriv8.exe"C:\Users\Admin\AppData\Local\Temp\Priv8 Grabber by vexelvoxpriv8.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4404
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\VCRUNTIME140.dll
- Size 106KB
- SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
- MD5 4585a96cc4eef6aafd5e27ea09147dc6
- SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
- SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
- SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_bz2.pyd
- Size 82KB
- SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
- MD5 3859239ced9a45399b967ebce5a6ba23
- SHA1 6f8ff3df90ac833c1eb69208db462cda8ca3f8d6
- SHA512 030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69
- SSDEEP 1536:PdQz7pZ3catNZTRGE51LOBK5bib8tsfYqpIPCV17SyQPx:VQz9Z5VOwiItsAqpIPCV1Gx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_ctypes.pyd
- Size 120KB
- SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
- MD5 bd36f7d64660d120c6fb98c8f536d369
- SHA1 6829c9ce6091cb2b085eb3d5469337ac4782f927
- SHA512 bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56
- SSDEEP 3072:c7u5LnIx1If3yJdqfLI2AYX5BO89IPLPPUxdF:cwxfijqfLI29BO8VF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_hashlib.pyd
- Size 63KB
- SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
- MD5 4255c44dc64f11f32c961bf275aab3a2
- SHA1 c1631b2821a7e8a1783ecfe9a14db453be54c30a
- SHA512 7d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52
- SSDEEP 1536:6TO+CPN/pV8ETeERZX/fchw/IpBIPOIVQ7SygPx:mClZZow/IpBIPOIVQyx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_lzma.pyd
- Size 155KB
- SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
- MD5 e5abc3a72996f8fde0bcf709e6577d9d
- SHA1 15770bdcd06e171f0b868c803b8cf33a8581edd3
- SHA512 b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6
- SSDEEP 3072:A4lirS97HrdVmEkGCm5hAznf49mNo2NOvJ02pIPZ1wBExN:VlirG0EkTVAYO2NQ3w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_queue.pyd
- Size 31KB
- SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
- MD5 f00133f7758627a15f2d98c034cf1657
- SHA1 2f5f54eda4634052f5be24c560154af6647eee05
- SHA512 1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201
- SSDEEP 384:AuCvO+MZFryl9SDCP6rXv+mkWsniRq9IPQUkHQIYiSy1pCQqIPxh8E9VF0NykOBw:1+yF+6rX2mk599IPQUO5YiSyv3PxWEun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_socket.pyd
- Size 77KB
- SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
- MD5 1eea9568d6fdef29b9963783827f5867
- SHA1 a17760365094966220661ad87e57efe09cd85b84
- SHA512 d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09
- SSDEEP 1536:0JltpedXL+3ujz9/s+S+pzpMoiyivViaE9IPLwj7SyZPx:07tp4i3ujz9/sT+pzqoavVpE9IPLwjHx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\_ssl.pyd
- Size 157KB
- SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
- MD5 208b0108172e59542260934a2e7cfa85
- SHA1 1d7ffb1b1754b97448eb41e686c0c79194d2ab3a
- SHA512 41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d
- SSDEEP 3072:LMaGbIQQbN9W3PiNGeA66l8rBk3xA87xfCA+nbUtFMsVjTNbEzc+pIPC7ODxd:LMaG0bN96oG1l8YA8ZMSR+E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\base_library.zip
- Size 1.8MB
- SHA256 ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
- MD5 e17ce7183e682de459eec1a5ac9cbbff
- SHA1 722968ca6eb123730ebc30ff2d498f9a5dad4cc1
- SHA512 fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1
- SSDEEP 24576:mQR5pATu7xm4lUKdcubgAnyfbazZ0iwh9EpdYf9P3sLoThUdWQhuHHa:mQR5plxm+zJ5uUwQ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\charset_normalizer\md.cp311-win_amd64.pyd
- Size 10KB
- SHA256 f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0
- MD5 28af0ffb49cc20fe5af9fe8efa49d6f1
- SHA1 2c17057c33382ddffea3ca589018cba04c4e49d7
- SHA512 9aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0
- SSDEEP 96:KJdp72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCF4ioUjQcX6g8cim1qeSju1:KJ72HzzjBbRYoe2oRcqgvimoe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- Size 110KB
- SHA256 a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7
- MD5 6cdca2fde9df198da58955397033af98
- SHA1 e457c97721504d25f43b549d57e4538a62623168
- SHA512 7b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92
- SSDEEP 1536:Oa+euGiytUbL3818SfqZpr0w2a5i5hBi0GmV4Ms7oTGKMl8g1d:OtezmbL38+SCZqw2aA8QV67oTGKw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libcrypto-1_1.dll
- Size 3.3MB
- SHA256 f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
- MD5 e94733523bcd9a1fb6ac47e10a267287
- SHA1 94033b405386d04c75ffe6a424b9814b75c608ac
- SHA512 07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f
- SSDEEP 98304:+/+YgEQaGDoWS04ki7x+QRsZ51CPwDv3uFfJx:MLgEXGUZ37x+VZ51CPwDv3uFfJx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\libssl-1_1.dll
- Size 688KB
- SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
- MD5 25bde25d332383d1228b2e66a4cb9f3e
- SHA1 cd5b9c3dd6aab470d445e3956708a324e93a9160
- SHA512 ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa
- SSDEEP 12288:ihO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0T9qwfU2lvzA:iis/POtrzbLp5dQ0T9qcU2lvzA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\python3.dll
- Size 65KB
- SHA256 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
- MD5 b711598fc3ed0fe4cf2c7f3e0877979e
- SHA1 299c799e5d697834aa2447d8a313588ab5c5e433
- SHA512 b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84
- SSDEEP 768:rw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSy:8/5k8cnzeJf9IPL037SyG3Px
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\python311.dll
- Size 5.5MB
- SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
- MD5 5a5dd7cad8028097842b0afef45bfbcf
- SHA1 e247a2e460687c607253949c52ae2801ff35dc4a
- SHA512 e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
- SSDEEP 49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgVr42I1vJHH++:73ZOKRtlrJ7wfGrs1BHeM+2PocL2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\select.pyd
- Size 29KB
- SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
- MD5 c97a587e19227d03a85e90a04d7937f6
- SHA1 463703cf1cac4e2297b442654fc6169b70cfb9bf
- SHA512 97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12
- SSDEEP 384:N1ecReJKrHqDUI7A700EZ9IPQGNHQIYiSy1pCQn1tPxh8E9VF0NykfF:3eUeJGHqNbD9IPQGR5YiSyvnnPxWEuN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI33322\unicodedata.pyd
- Size 1.1MB
- SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
- MD5 aa13ee6770452af73828b55af5cd1a32
- SHA1 c01ece61c7623e36a834d8b3c660e7f28c91177e
- SHA512 b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f
- SSDEEP 12288:83kYbfjwR6nblonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ol:8UYbMA0IDJcjEwPgPOG6Xyd461ol
- MD5 SHA1 SHA512 SSDEEP