26a6a0f80fd67ce76dce9c5cd86c2708928e89e9e913db170185d01a754bdb6c

Resubmissions

08-11-2024 13:48

241108-q3485awkfk 10

08-11-2024 13:46

241108-q223datcja 10

08-11-2024 08:42

241108-kmfmya1ran 10

07-11-2024 20:12

241107-yzb26s1jem 10

Analysis

max time kernel
0s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

6.0MB
MD5

debeded9be69d361e04e12b6edfbce3e
SHA1

c671c4261bd8ae2331039e0b0d8f7a384d7859dd
SHA256

26a6a0f80fd67ce76dce9c5cd86c2708928e89e9e913db170185d01a754bdb6c
SHA512

3556204686dd75e58864508a26fdd6f37942094d7089c8f11c5d1e30ec30b4d5c3022e2f13c243a26c10dfe77a35557693e55fe77c20483ed154dce60c1b9f23
SSDEEP

98304:j+EtdFB4kkamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RlOLPt9J9Dzy1:jdFikFeN/FJMIDJf0gsAGK4RQLPt9D21

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
112	Built.exe
112	Built.exe
112	Built.exe
112	Built.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023c94-21.dat	upx
behavioral1/memory/112-25-0x00007FF8E89E0000-0x00007FF8E8E4E000-memory.dmp	upx
behavioral1/files/0x0007000000023c87-27.dat	upx
behavioral1/memory/112-30-0x00007FF8FC780000-0x00007FF8FC7A4000-memory.dmp	upx
behavioral1/files/0x0007000000023c92-29.dat	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 112	5024	Built.exe	85
PID 5024 wrote to memory of 112	5024	Built.exe	85

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI50242\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\_ctypes.pyd

Filesize
56KB

MD5
813fc3981cae89a4f93bf7336d3dc5ef

SHA1
daff28bcd155a84e55d2603be07ca57e3934a0de

SHA256
4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

SHA512
ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\base_library.zip

Filesize
859KB

MD5
07d86d3854f6fed735b0cbf6781a9264

SHA1
a5e24d2d5645cfca463e47757712b59c238b3b8c

SHA256
41e5fbd199eb172d47c5b0385cc78e902211a729ea9142ab100f76f63c607a69

SHA512
8c2852f44a9d6c554c0fb23be7d5136f752e6389daf6e0e23e75e241a6b53632ad44f05aab5b29abe78dd84e6953195b42d3b6d1d5773ad3ddb6a2a826c38e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
memory/112-25-0x00007FF8E89E0000-0x00007FF8E8E4E000-memory.dmp

Filesize
4.4MB

Download
memory/112-30-0x00007FF8FC780000-0x00007FF8FC7A4000-memory.dmp

Filesize
144KB

Download