1ecfdd3482190c327d2d06976b42088cbeb698c4c22b2bd4561e835280ed66d0

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

python/Python234.exe
Size

9.4MB
MD5

65275cc93b905c25d130d71c116892f2
SHA1

28215f1d9f3f1ff39822f09bdfa73641af12d39d
SHA256

08d5dc9d7b05a0dfdbcbe4f19dccb672bedee126244599796eea85cd9aa07aad
SHA512

dc33f502014ba73cc0e8a101405fa728d3e5ddd74088ee0a37de5b389febf24ccff3c2bca5da4e294f8a5d564841a0cfd2adb05ef507ca0ba8672fd0bed07f0c
SSDEEP

196608:DujmDGNuHcQeI3FgUXtTvzmYpnS+XlKfgKWIbl1IdGQEITRyxdhjyjQ2tc/uC:DujkGCemFRnmKpKfgaWwQEQRyxdhjijw

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2276	Python234.exe
2276	Python234.exe
2276	Python234.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	Python234.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Python234.exe

C:\Users\Admin\AppData\Local\Temp\python\Python234.exe
"C:\Users\Admin\AppData\Local\Temp\python\Python234.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GLCAFD7.tmp

Filesize
161KB

MD5
09e59d00df5d2effd8dd9b30385cb9d2

SHA1
0fa0d3f6692f31fdabefb719b0f7a28cbf5d5415

SHA256
1c574eab5e83ccfe5a0bb7b59e028cc5fa2f4e77868051e305d83c709711ff77

SHA512
d73e3832777341a4176dbd9988002ec94a32f162492e869a8c03d9bb10f1833821f99e15710e9fc103a2820c862cf14a0b990d7c7c09150bb14618a7c93ca5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLFBBA2.tmp

Filesize
10KB

MD5
9da8f742593d4bbca708b90725282ae2

SHA1
9aaa6ed98726e657252a098f2bf06066a8604d27

SHA256
e362a9815527869e0f71fdf766a1c3648e307145defda7a5279914e522bcb57c

SHA512
f8b4129dc4ab30e009cb4db8a80f06b16306c1a90a49e534befb925d6ce4d5713b98553a2107b40efa8b5abd025ff0556976cf46c3642ce8e372c34d105e36cb

Download Submit