a33e23a800443b8d6a35a4e950c1057073b83246658bde36c071910b8cdbb2ca

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Soul Multi-Tool v2.exe
Size

18.5MB
MD5

4379a4a16e642722b022fcb46b67705f
SHA1

8510cd3708d276b59f101217cf55b9a82eae5aa9
SHA256

a33e23a800443b8d6a35a4e950c1057073b83246658bde36c071910b8cdbb2ca
SHA512

500171eea385bcc27f0e14c518e4fc128a312ef3a0125c469a1cb9f841f7bc91732f46f05610bb574fa8c03f91a8fbe077b61777cdafb0768f88ab9edd725908
SSDEEP

393216:w853BXMCHWUjRcuIVnONf/PtfN3sCz3Hq2l6XUblkYkZMo:w23BXMb8GFnOR/11d3zkXUbSMo

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe
2520	Soul Multi-Tool v2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2520	2880	Soul Multi-Tool v2.exe	31
PID 2880 wrote to memory of 2520	2880	Soul Multi-Tool v2.exe	31
PID 2880 wrote to memory of 2520	2880	Soul Multi-Tool v2.exe	31

C:\Users\Admin\AppData\Local\Temp\Soul Multi-Tool v2.exe
"C:\Users\Admin\AppData\Local\Temp\Soul Multi-Tool v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\Soul Multi-Tool v2.exe
  "C:\Users\Admin\AppData\Local\Temp\Soul Multi-Tool v2.exe"
  2⤵
  - Loads dropped DLL
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-core-file-l2-1-0.dll

Filesize
22KB

MD5
e1d37d21f7875483ae0d187032d5714c

SHA1
51a945a9e6ccf994781a028cd07ab8ee820f542c

SHA256
1076a19f2a42a35c8639fb1ce1666d046e0fd259142f7e645e350211d9d6390f

SHA512
77973d6e5e6ad68b304f50184a95be9d4993338f4f69e07c11275951b2fcfdc02c061182d1a7a394dc18fe77d6d021dd9e8e17cdfbbb8d0c77752c6df1979011

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\python313.dll

Filesize
5.8MB

MD5
b9de917b925dd246b709bb4233777efd

SHA1
775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2

SHA256
0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99

SHA512
f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Africa\Conakry

Filesize
148B

MD5
09a9397080948b96d97819d636775e33

SHA1
5cc9b028b5bd2222200e20091a18868ea62c4f18

SHA256
d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

SHA512
2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Africa\Djibouti

Filesize
265B

MD5
86dcc322e421bc8bdd14925e9d61cd6c

SHA1
289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

SHA256
c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

SHA512
d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Africa\Kigali

Filesize
149B

MD5
b07064beada5be6289ed9485ecc9733d

SHA1
b0ff96d087e4c86adb55b851c0d3800dfbb05e9a

SHA256
444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb

SHA512
0ce1322f4a6f6568cdf61fc699eead4147015829650e90d791c223b45f3a23ead720ff41b4c8cc10ee915175e052d4740347a4454d23c18a3c57d30ded5a904c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Africa\Lagos

Filesize
235B

MD5
8244c4cc8508425b6612fa24df71e603

SHA1
30ba925b4670235915dddfa1dd824dd9d7295eac

SHA256
cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

SHA512
560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\America\Curacao

Filesize
246B

MD5
adf95d436701b9774205f9315ec6e4a4

SHA1
fcf8be5296496a5dd3a7a97ed331b0bb5c861450

SHA256
8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

SHA512
f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\America\Toronto

Filesize
3KB

MD5
8dabdbbb4e33dcb0683c8a2db78fedc4

SHA1
a6d038ecff7126ee19ebb08a40d157c9a79964cd

SHA256
a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f

SHA512
35bfd5182535f5257d7ee693eb6827751993915129d7f3cc276783926b1f4db7a00d8f0b44a95ac80c294a9cc1b84bda6418134c2a5c10ba6c89946bd8ef97a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\EST

Filesize
182B

MD5
0972a9c4c28bf71eeab5f0bac573cdbc

SHA1
a94fbc2d567e41723f03629b6c9a864260108a17

SHA256
91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0

SHA512
ece548f7d840a588523aacddc93891e0dd300390f79de063e60074e00a92ae33a8201642b841ff868387f1ac2188c485cce941d83c7a3617d27ac286dbcc0c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Etc\Greenwich

Filesize
114B

MD5
9cd2aef183c064f630dfcf6018551374

SHA1
2a8483df5c2809f1dfe0c595102c474874338379

SHA256
6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

SHA512
dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Europe\London

Filesize
3KB

MD5
a40006ee580ef0a4b6a7b925fee2e11f

SHA1
1beba7108ea93c7111dabc9d7f4e4bfdea383992

SHA256
c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

SHA512
316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Europe\Oslo

Filesize
2KB

MD5
7db6c3e5031eaf69e6d1e5583ab2e870

SHA1
918341ad71f9d3acd28997326e42d5b00fba41e0

SHA256
5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

SHA512
688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Europe\Skopje

Filesize
1KB

MD5
6213fc0a706f93af6ff6a831fecbc095

SHA1
961a2223fd1573ab344930109fbd905336175c5f

SHA256
3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

SHA512
8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\MET

Filesize
2KB

MD5
355f0d3e2a3ee15ea78526f5eeb0cf7d

SHA1
d90f3247c4716c2e1068d5ad9c88ca2091bec4e8

SHA256
812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0

SHA512
96a5fa48a15167e55ffad5b0241c90caeb7f0433ad62dd43463a4c52c25c59f7357681cb586fc52e812e8173adc12cec9eff66d27d5f41e19d55f6c1fce12937

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\PRC

Filesize
561B

MD5
09dd479d2f22832ce98c27c4db7ab97c

SHA1
79360e38e040eaa15b6e880296c1d1531f537b6f

SHA256
64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

SHA512
f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Pacific\Wallis

Filesize
152B

MD5
5bdd7374e21e3df324a5b3d178179715

SHA1
244ed7d52bc39d915e1f860727ecfe3f4b1ae121

SHA256
53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

SHA512
9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\Pacific\Yap

Filesize
172B

MD5
ec972f59902432836f93737f75c5116f

SHA1
331542d6faf6ab15ffd364d57fbaa62629b52b94

SHA256
9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

SHA512
e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\UCT

Filesize
114B

MD5
38bb24ba4d742dd6f50c1cba29cd966a

SHA1
d0b8991654116e9395714102c41d858c1454b3bd

SHA256
8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

SHA512
194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pytz\zoneinfo\US\Mountain

Filesize
2KB

MD5
648f67a7744849f2ca07f4d5871e9021

SHA1
faa7d6cf4178d032d8ba8a4d77eac0fd47f8a718

SHA256
32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9

SHA512
3dab6d6a04a4856cba78ef499f1a436f1f71b1dea494ee098b76c1702531108ae0a1d7b6de05e9d9315027624b790e084d69b25507738099f6026cd2a9559f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\ucrtbase.dll

Filesize
1.1MB

MD5
a6b4fba258d519da313f7be057435ee4

SHA1
0bf414057d0749e9db4da7683eb6d11be174cdd5

SHA256
aa092722797b9a74e9463516e6c63d4d3c904ac263f4a4ea421b0d4d4875f606

SHA512
34f3d006a9bb7835e9d82465874e059a328c8d69abd61c79d6a85a7702df582dabc93126918a0514356fda2810c77acc1d6070ad4418921bd9e8efe34697e4a1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-core-file-l1-2-0.dll

Filesize
22KB

MD5
b38d5b15f77e6cd93763c76ff1bc79ee

SHA1
cadffe8a06835a7c1aa136a5515302d80d8e7419

SHA256
aa9e41933f1cf1c3bcc3b65771297b0ef088fac153c7997c0d48e7882714d05f

SHA512
46eaeb419654efd999146b9cd55ece42939e071f089ccb4698a09f4bb6b881106a3e342901439f867f609c1147ef151832b2919d2a33726643a6e5c4086a5f3a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-core-localization-l1-2-0.dll

Filesize
22KB

MD5
09fed91680050e3149c29cf068bc10e5

SHA1
e9933b81c1d7b717f230ea98bb6bafbc1761ec4a

SHA256
3c5900c9e7fbada56e86d8973a582771dde6bff79ca80ae05920a33a2cc435df

SHA512
e514590385561731f2ad18afd6bcefac012ea8061a40b6ccfda4e45ff5768617b2e1b06e849e8a640a10ca59039e89ba88cac5d3b7ff088968eb4bc78e212d3a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
22KB

MD5
0f99a725b93375f0ba8795e67e5a4fdf

SHA1
9825f0ec9cc4ba99471f4587d4bf97f7083d5f93

SHA256
be77a15dcaf73a7c1be6c62f57e79ef7bbc305e1b7753a4345ba1d88851dba08

SHA512
f95b6472b78f2bea732c6cc4933c83da7cbbf3eec67544b9faf86c6d6183c23e47afadb23e78420ed2dcec7ddde819e0fcb14345614c5acb3d959fca7c5a7468

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28802\api-ms-win-core-timezone-l1-1-0.dll

Filesize
22KB

MD5
dd86613bbc3da5e41d8bd30803d87c1f

SHA1
35690b9b0fe48f045568e25221694be041f56d4f

SHA256
2312923d7e07c1f58f457ac434b89c01ce675ff42d74bb279326d6c573f675ed

SHA512
6d4a29c99e819368389a9347a719e78125dfbc3166af85425db81f38833b57ba28251472dd42db974876bcf8bc73465d638678b06e3482ceb36c19b943f41ca4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads