Overview

overview

7

Static

static

3

Cwelium.exe

windows10-1703-x64

3

Cwelium.exe

windows10-2004-x64

7

Cwelium.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 16:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Cwelium.exe
  • Size 12.8MB
  • Sample240915-thnmes1gmf
  • SHA256 e289a8dcdbf730adc13799ecf0bc2217a43a80a660989bf160c2c9d38dec23f2
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 20 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
    "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\Cwelium.exe
      C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3256
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:4356

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
          • Size 82KB
          • SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
          • Size 120KB
          • SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
          • Size 31KB
          • SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
          • Size 157KB
          • SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
          • Size 287KB
          • SHA256 1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
          • Size 29KB
          • SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tls-client-64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll
          • Size 17.8MB
          • SHA256 b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Cwelium.exe
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\Cwelium.exe
          • Size 14.9MB
          • SHA256 0468c8482e935a21dde66bf9a90de24d164619b33834f80280519c55d1f31254
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\_hashlib.pyd
          • Size 63KB
          • SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\_lzma.pyd
          • Size 155KB
          • SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\_socket.pyd
          • Size 77KB
          • SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\_uuid.pyd
          • Size 24KB
          • SHA256 f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\charset_normalizer\md.pyd
          • Size 10KB
          • SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md__mypyc.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\charset_normalizer\md__mypyc.pyd
          • Size 116KB
          • SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\libssl-1_1.dll
          • Size 688KB
          • SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\python311.dll
          • Size 5.5MB
          • SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\unicodedata.pyd
          • Size 1.1MB
          • SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          backend_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_1788_133708898335191541\zstandard\backend_c.pyd
          • Size 512KB
          • SHA256 b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1788-69-0x00007FF675170000-0x00007FF675E63000-memory.dmp
          Download

          memory/3256-70-0x00007FF6EE230000-0x00007FF6EF154000-memory.dmp
          Download

          memory/3256-71-0x00007FFDBDBF0000-0x00007FFDBED7F000-memory.dmp
          Download