28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
Size

5.8MB
MD5

eccd762337190e614b56a3e6b5f4290e
SHA1

79514eeaef48c9dfdf8274d0a9d6f7dc99c28838
SHA256

28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64
SHA512

67041274affe114ee2170101758ddeef9e2ed541e1e404d0cd4179730fdeb7842245faffd249791e00ce67e52d7a4798e00ca715553cdc0752deb4325541847b
SSDEEP

98304:0r8vCvFpDg0qRXeRt79vdIWXe+q2WWmQNfTBBGzQuKLQ59PzNHg05IZMjaftqRxN:0rRvfDJQOz7Fd9e+q2WWmQNLBBGZlrRS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 20 IoCs

pid	Process
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	2836	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2836	2380	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe	31
PID 2380 wrote to memory of 2836	2380	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe	31
PID 2380 wrote to memory of 2836	2380	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe	31

C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
"C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
  "C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23802\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
285e3257c5a12d3384cd3f5a3ae941b2

SHA1
c05f6a72b73bc7ec8409ed42ccd947f501da0166

SHA256
8355bf70788c00fb1a17bc4160bcdc6930fa219b85473e08138efc10136d90eb

SHA512
f1ee0689b02e6a6e95940c1b3c2cc6902f3e04db44f4d767a1e68a890b7b3733b28c1d86f1f361f0db8b1ee955f5f5bca86b758b8f2e93d94b5bc4d469187df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
72d542226f067dae07562fd093b0f5f0

SHA1
c0f7f85753bb351c51dd8e36ca2366a3b24c73ba

SHA256
e8e3550084cf30e16b16216266bc73b07c1a05bbfd94ee3f645122d3d167d7e6

SHA512
2fbf32b38852def53891a73b9b33f33de96ca09102baa8c37f02d1b3d5076b26d2a32f2e79aab1009dc5b2464abf50c956c797ba4321fd37ea13900753a1d182

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
55902b92bbbca7a2d11a946297f583e6

SHA1
b6158f009d98a98ed2e56d377f9c4b6323b852fc

SHA256
2dea4ae5df0f7daa37e26dd0f9232f867884f57e850aa85062594b54f3a81e98

SHA512
85e0df8a390260e4e0cc0a9372dfd3c55464486812926775a5f9f5767157b88783e03701b1f1c28f34e822b21ea7436c3e8270df58f8de3ec1b15f68b633f4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d2eeb9f6789213bfda7fe6bcb2a1540a

SHA1
c330267c8abd56c04204deee9aabd566268daf97

SHA256
0ec2b6ee5e8ee5ee22b810795d097dd769ef054eb394355eecac1a1fdc18c971

SHA512
7795e972f46ec84cb1709354a40684593947cbf6b4df373cd823134a0b2deec7e5dc738a74c13c2accb74c467892d9a2375a96ab85147ae42fadc627a0f7e2cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f2d0493794b45c6a2629fc9c5c80f832

SHA1
12460ab8f625ecd0e0a02b4fa82061c2ff4644b8

SHA256
8c2d7b0dca0702b8f1870c9c404f41e00624132b239deb7917096dfed8ca1507

SHA512
4f44ea443413c3709c1521de0b9dc5c05ef9a4f853062e44658d7bc54663115afc1f04927797a5406b388cd5c9e226c9fea1f73f0c288999105d9db42fa257e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
d2de2615f123ce2bed3332d505a99385

SHA1
9f2ea75348020d271222fff7984c8ef21aee460e

SHA256
da36262bd3865024a6ec9726b8fcd0764ef3ddafe21387314c0bbb89a478e4e9

SHA512
a5e99e724a847c2193ce052dbedf0cd19a8765e3561ec028cd28e5972c8f004e257de0d5dd3870d41213a6cc84492ad488bd05106d2b5d3aa19f808eec820d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
66a41a8156a7f9cae4a7977cb8084fa7

SHA1
4c72b0d8c90daf993fa0371269af04703a81fe4d

SHA256
a454bd7a8fb18d19e3264855ec7ade9820b54fab31f9528bf1abc8cfe32e064b

SHA512
989ec1a0deff20bc9b3099a21bf9d45bf821e94eabfc1b18ba4ece1689d0cbcf83b6206bcf64530a55aac1d4165a54c395f8db17fe5d68778082dfb1db4f0d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
89abe10555d85e9bd183fae2c37d7aaa

SHA1
05c72b53f7d7b0667ff6cb14255e5c6453f1f35a

SHA256
d524f5aff8a3deaf37899187fed40b821c5e79251b99d0a8571b62ad87adffb2

SHA512
7b9c38e5270c401acb1b51ccf82ff0249671c4df905c31bc934d8d0b15a6eae22d3d82381199e4d61ac717bbe72726bd2f9b6c4b2fc930b39ec2c31d9fb1147d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
7dbc1ca1f1103cd971a67709d5203dbd

SHA1
717e689b96a5d029558e7cb663d5c7cda840b780

SHA256
88a6dc7c08725b447dd1b7061990977246dc62b7282dfb50fa36659627079fb1

SHA512
ec58c7bb26f669f5b90731ab8c787b3b4e4131d7a9450dfae4d74ef24541a51c98ee8cc71dd4744a242dfde2f75feb216727daccb18bf745e2539546fef746d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
dedf6460cb6fc8229b3e889d1b32f75e

SHA1
f47e35654cb90ed4505ba49a92b2fdc661c0fe8a

SHA256
bae857fe8e162640032aa8d7a88217a021810d305bc58b8f27409155f2299adb

SHA512
b1ce0119c2eb87ee36fe566477d14d317d01465319b72f7afd2f83a88f82591afb6f795eef76b20c0b13060530f67a4dc07923fd2f61922fdea06973c70f8352

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
21f5271a151394a654b2f1c44fc44049

SHA1
1d2f98700ee87fc747b230b908fea133b730bf0a

SHA256
a7a987527a2f7ad4474cc5be04e5bbc10375e072573b13a2cf3fe705789bf822

SHA512
cc46e3bdcd25f2d72802581955ee69af97781b19a40a51fb318206ca6916f188f40dd94a7a5e6bc2c4c2ce211229d03e50729b168ed771e52cee188d0c30638d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
514a74d1050e7bdcbb1f422fb571c351

SHA1
5a82976e2456fe3f215316a85301460c6af389d7

SHA256
62e97230bbe85c0e2930d16cadf830acdbf9f2bccedd3d51fa8ee0c5102ac63a

SHA512
f2b19fe5fc4f95ec3a1b0d76e8e6767234c83a8b8a08ec6a2ba9b3620c08f67132fb7629235aee27ec172d6efa5260209e005564467abe3ec06f1a7756d21da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
90d42fdf308dfd771797dd41585d3baf

SHA1
daea1f05092de97ea558de14b4e112ad48b77726

SHA256
404ff7454e8dd3d766e433def1780a265ddc87a07981d223d241a528cc78c0fe

SHA512
e8f35f6087b9601d8a46b2534634f24a2841ff2cde9f6b7bc10326cf2197e98bae9c6ddcb2e53e8f81a984019b72080d1e826731fb6d7c28fdb47373c1e474f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
6856722db8c9e3dbb7fc62938ad2cf1e

SHA1
6d1aa306d7793916adb30e9aac451b2e43516abe

SHA256
3d077c3cfa0a54f6f58814deee22d3dcf4bcaad44ae405b8d31552a9afabc086

SHA512
87a3c82af000fc1cfee5f12f01f077c2c87638245b2784e8827c587985f8c0014685d0d15a1498a01dcfcfe717cfbb9ee64344ae7a78aa75bdb65e2a0aef07cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
dec83f473e43ee78e92a4b682a9a7904

SHA1
ce5e0479c78ad6ffa7d765479a7e1a7157eca4a3

SHA256
a5c05a8394c5aa71441ac18e945170a755d1f1ff141e614cdd92dc5737426a5b

SHA512
60bbd86035bbf3f80c17a01fb44ea5af5c84584a8aa5f34a7e0abf989ccccf8d40bab4d44af364c8ccf62ce4e21df0ed2c51bb70e817b2bf9c5319dbfd4100d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
88b5f9bc871438973ef12782e0c8d12f

SHA1
d327208b4f26c1c6f0e9df50ecb22a89b426465d

SHA256
4691510b2bc2ba15b638a0d1765c2a8826a8b9fdbe3737989d8fea072fe7c20b

SHA512
d4de343a88c9933af67c4599d308f31332ca7a3ea0428fbad2d60e2fa2165eca9ea56410437be1154c551e7263dd6a5773e6f7c4dc5b6952e8b767a3c5b16597

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
f862bd9516845b31973ba98e9f1288b3

SHA1
ada580fc93b4f5a86db92e1d612293ccc21c72f9

SHA256
72d31abee96fb3ee1d90afcf11fdc54ceba131bbb912b994761f32cd7cfc3ee1

SHA512
bb442aab30bb0d8797586eaafa53a6deaaaff19d41342b9fb828c87fc468d96953f8ed1123ace4c4d371f9eed91c2bf2c42b1d8ca92bbd0a89bc5a27a877a15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\base_library.zip

Filesize
776KB

MD5
af13fd074531a90928f2dca912f0356a

SHA1
bb2ce92794478a88191f4bda01fd6fec58378595

SHA256
750fe26efd96674d32df7e00eddb03d88ae4a3eb8d4f99d8f00a9c2d4caaef48

SHA512
0d77fafeb095819090738325e0aa5eef236f2a5e89dd1438dfc1aaaf2ac1d43384584fab003df2586e4fde4dd962487499627240dcb01bc51e0c2e63528cbbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\python37.dll

Filesize
3.6MB

MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23802\ucrtbase.dll

Filesize
978KB

MD5
cca4929ef8dd988d7221ef6ba398f1b5

SHA1
1d21e60e56a15038702dc18148be8cecee279890

SHA256
4292c29e74d90aef21bbad50e8fe25858c5990846adb629372ca6fd717cd0ca3

SHA512
d990d1370201541e7a1e1ec9b68e40a984d0195847010919148d0de80d2a2c51bcccfeeca59087fca95ab410c9e170c4585c8daa1383f1383b98500d797a41ca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads