28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
Size

5.8MB
MD5

eccd762337190e614b56a3e6b5f4290e
SHA1

79514eeaef48c9dfdf8274d0a9d6f7dc99c28838
SHA256

28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64
SHA512

67041274affe114ee2170101758ddeef9e2ed541e1e404d0cd4179730fdeb7842245faffd249791e00ce67e52d7a4798e00ca715553cdc0752deb4325541847b
SSDEEP

98304:0r8vCvFpDg0qRXeRt79vdIWXe+q2WWmQNfTBBGzQuKLQ59PzNHg05IZMjaftqRxN:0rRvfDJQOz7Fd9e+q2WWmQNLBBGZlrRS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4612	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
4612	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
4612	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4612	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4612	3504	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe	84
PID 3504 wrote to memory of 4612	3504	28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe	84

C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
"C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe
  "C:\Users\Admin\AppData\Local\Temp\28b1d1f658f5fc0f02e6de7fe563219cc1c58cb3d54417f8f2e420a3ed6e2b64.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI35042\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35042\base_library.zip

Filesize
776KB

MD5
af13fd074531a90928f2dca912f0356a

SHA1
bb2ce92794478a88191f4bda01fd6fec58378595

SHA256
750fe26efd96674d32df7e00eddb03d88ae4a3eb8d4f99d8f00a9c2d4caaef48

SHA512
0d77fafeb095819090738325e0aa5eef236f2a5e89dd1438dfc1aaaf2ac1d43384584fab003df2586e4fde4dd962487499627240dcb01bc51e0c2e63528cbbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35042\python37.dll

Filesize
3.6MB

MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35042\ucrtbase.dll

Filesize
978KB

MD5
cca4929ef8dd988d7221ef6ba398f1b5

SHA1
1d21e60e56a15038702dc18148be8cecee279890

SHA256
4292c29e74d90aef21bbad50e8fe25858c5990846adb629372ca6fd717cd0ca3

SHA512
d990d1370201541e7a1e1ec9b68e40a984d0195847010919148d0de80d2a2c51bcccfeeca59087fca95ab410c9e170c4585c8daa1383f1383b98500d797a41ca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads