Malware Analysis Report

2025-01-22 08:46

Sample ID 241027-vq4t2sxmdn
Target DiscordBruteForcer.exe
SHA256 7a2ff53d253222d267bd8b42c20443fed034c1d17e246e5fc403c13c5c252b22
Tags
pyinstaller spyware stealer discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

7a2ff53d253222d267bd8b42c20443fed034c1d17e246e5fc403c13c5c252b22

Threat Level: Shows suspicious behavior

The file DiscordBruteForcer.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller spyware stealer discovery

Loads dropped DLL

Reads user/profile data of web browsers

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

Opens file in notepad (likely ransom note)

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 17:12

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 17:12

Reported

2024-10-27 17:15

Platform

win7-20240708-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI19602\python313.dll

MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 17:12

Reported

2024-10-27 17:15

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe

"C:\Users\Admin\AppData\Local\Temp\DiscordBruteForcer.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c title discord.gg/byteengine

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI49482\python313.dll

MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33

C:\Users\Admin\AppData\Local\Temp\_MEI49482\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

C:\Users\Admin\AppData\Local\Temp\_MEI49482\base_library.zip

MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_ctypes.pyd

MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc

C:\Users\Admin\AppData\Local\Temp\_MEI49482\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_bz2.pyd

MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_lzma.pyd

MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_wmi.pyd

MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_ssl.pyd

MD5 1c0e3e447f719fbe2601d0683ea566fc
SHA1 5321ab73b36675b238ab3f798c278195223cd7b1
SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
SHA512 e1a430da2a2f6e0a1aed7a76cc4cd2760b3164abc20be304c1db3541119942508e53ea3023a52b8bada17a6052a7a51a4453efad1a888acb3b196881226c2e5c

C:\Users\Admin\AppData\Local\Temp\_MEI49482\select.pyd

MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4

C:\Users\Admin\AppData\Local\Temp\_MEI49482\libssl-3.dll

MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_socket.pyd

MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_hashlib.pyd

MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_queue.pyd

MD5 1c03caa59b5e4a7fb9b998d8c1da165a
SHA1 8a318f80a705c64076e22913c2206d9247d30cd7
SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
SHA512 783ecda7a155dfc96a718d5a130fb901bbecbed05537434e779135cba88233dd990d86eca2f55a852c9bfb975074f7c44d8a3e4558d7c2060f411ce30b6a915f

C:\Users\Admin\AppData\Local\Temp\_MEI49482\charset_normalizer\md.cp313-win_amd64.pyd

MD5 56fe4f6c7e88212161f49e823ccc989a
SHA1 16d5cbc5f289ad90aeaa4ff7cb828627ac6d4acf
SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
SHA512 7c9d09cf9503f73e6f03d30e54dbb50606a86d09b37302dd72238880c000ae2b64c99027106ba340753691d67ec77b3c6e5004504269508f566bdb5e13615f1e

C:\Users\Admin\AppData\Local\Temp\_MEI49482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

MD5 10116447f9276f10664ba85a5614ba3a
SHA1 efd761a3e6d14e897d37afb0c7317c797f7ae1d6
SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
SHA512 c04461e52b7fe92d108cbdeb879b7a8553dd552d79c88dfa3f5d0036eed8d4b8c839c0bf2563bc0c796f8280ed2828ca84747cb781d2f26b44214fca2091eae4

C:\Users\Admin\AppData\Local\Temp\_MEI49482\unicodedata.pyd

MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3

C:\Users\Admin\AppData\Local\Temp\_MEI49482\certifi\cacert.pem

MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

C:\Users\Admin\AppData\Local\Temp\_MEI49482\libcrypto-3.dll

MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

C:\Users\Admin\AppData\Local\Temp\_MEI49482\_decimal.pyd

MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5

C:\Users\Admin\AppData\Local\Temp\_MEI49482\VCRUNTIME140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_raw_ecb.pyd

MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_raw_cbc.pyd

MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_raw_ofb.pyd

MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_raw_cfb.pyd

MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_raw_ctr.pyd

MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Hash\_SHA1.pyd

MD5 556e6d0e5f8e4da74c2780481105d543
SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Hash\_SHA256.pyd

MD5 cde035b8ab3d046b1ce37eee7ee91fa0
SHA1 4298b62ed67c8d4f731d1b33e68d7dc9a58487ff
SHA256 16bea322d994a553b293a724b57293d57da62bc7eaf41f287956b306c13fd972
SHA512 c44fdee5a210459ce4557351e56b2d357fd4937f8ec8eaceab842fee29761f66c2262fcbaac837f39c859c67fa0e23d13e0f60b3ae59be29eb9d8abab0a572bb

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Cipher\_Salsa20.pyd

MD5 f19cb847e567a31fab97435536c7b783
SHA1 4c8bfe404af28c1781740e7767619a5e2d2ff2b7
SHA256 1ece1dc94471d6977dbe2ceeba3764adf0625e2203d6257f7c781c619d2a3dad
SHA512 382dc205f703fc3e1f072f17f58e321e1a65b86be7d9d6b07f24a02a156308a7fec9b1a621ba1f3428fd6bb413d14ae9ecb2a2c8dd62a7659776cffdebb6374c

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Protocol\_scrypt.pyd

MD5 3b1ce70b0193b02c437678f13a335932
SHA1 063bfd5a32441ed883409aad17285ce405977d1f
SHA256 eb2950b6a2185e87c5318b55132dfe5774a5a579259ab50a7935a7fb143ea7b1
SHA512 0e02187f17dfcfd323f2f0e62fbfe35f326dcf9f119fc8b15066afaeee4eb7078184bc85d571b555e9e67a2dd909ec12d8a67e3d075e9b1283813ef274e05c0d

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Util\_cpuid_c.pyd

MD5 44b930b89ce905db4716a548c3db8dee
SHA1 948cbff12a243c8d17a7acd3c632ee232df0f0ed
SHA256 921c2d55179c0968535b20e9fd7af55ad29f4ce4cf87a90fe258c257e2673aa5
SHA512 79df755be8b01d576557a4cb3f3200e5ee1ede21809047abb9ff8d578c535ac1ea0277eda97109839a7607af043019f2c297e767441c7e11f81fdc87fd1b6efc

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Hash\_BLAKE2s.pyd

MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f

C:\Users\Admin\AppData\Local\Temp\_MEI49482\Crypto\Util\_strxor.pyd

MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-27 17:12

Reported

2024-10-27 17:15

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pyc C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.pyc\ = "pyc_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\pyc_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-27 17:12

Reported

2024-10-27 17:15

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

155s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.pyc C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\edit C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\edit\command C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\open C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\.pyc\ = "pyc_auto_file" C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\open\command C:\Windows\system32\OpenWith.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" C:\Windows\system32\OpenWith.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 2280 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4836 wrote to memory of 2280 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.pyc

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp

Files

N/A