0a6c1e1a35167a351a778fb7b097644bbab9dce817377e8fae36c34ceddcfa52

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

updater/python-3.13.1-amd64.exe
Size

27.4MB
MD5

90176c0cfa29327ab08c6083dcdcc210
SHA1

cc0bcf37414be313526d63ef708fc85da3b693b1
SHA256

6b33fa9a439a86f553f9f60e538ccabc857d2f308bc77c477c04a46552ade81f
SHA512

5940aae44386f3622dee3f32e6a98073851a9f646da6bf3e04f050b9a9239e0ddf50b26e5e125154edc5bbebce7353d273950f1111e4ca5f2b4e2e4a7ac7cf92
SSDEEP

786432:fKScWFPQmn8ZNPeBvm1+MS3gpir9K8X+a:CcJQS8aBvm16gpGvX+a

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2256	python-3.13.1-amd64.exe

Loads dropped DLL 2 IoCs

pid	Process
1896	python-3.13.1-amd64.exe
2256	python-3.13.1-amd64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.1-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.1-amd64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30
PID 1896 wrote to memory of 2256	1896	python-3.13.1-amd64.exe	30

C:\Users\Admin\AppData\Local\Temp\updater\python-3.13.1-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\updater\python-3.13.1-amd64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Temp\{4A000A2E-D503-45BC-A557-B84052A666A2}\.cr\python-3.13.1-amd64.exe
  "C:\Windows\Temp\{4A000A2E-D503-45BC-A557-B84052A666A2}\.cr\python-3.13.1-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\updater\python-3.13.1-amd64.exe" -burn.filehandle.attached=292 -burn.filehandle.self=296
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{F10AFA70-A0D4-4543-9CB4-EC27B9B51F3F}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
\Windows\Temp\{4A000A2E-D503-45BC-A557-B84052A666A2}\.cr\python-3.13.1-amd64.exe

Filesize
878KB

MD5
9bc2cfce73fe043e69c909fb1546dbbf

SHA1
8ee81917775b4bd60ea0592b2203d2219dc98cfa

SHA256
ba89d23a7c937c05feba316a927773faaf7becfb2279d9edac6cc11e31205e29

SHA512
4243b3923b998b21ed386750b179bf29bda164d6154e2f5cd744b361963c4e1025ed3d6d557f1cad672818a909cc8a5036cf14ccf4f5bdd1284db24156ad58e7

Download Submit
\Windows\Temp\{F10AFA70-A0D4-4543-9CB4-EC27B9B51F3F}\.ba\PythonBA.dll

Filesize
692KB

MD5
e8cd5641cae8ae7e9f98b8a3b7096808

SHA1
dd587894cad3122c1719def17f8377bb2bbbc05e

SHA256
898474ad4074571813416e58667a3b8a233e12e656579726c178ec71f794b268

SHA512
53034732df45527389362c2cc53d3ba0390bc4c1a7700b7d61d774d1eecdfed43381311c63b38861215813a674eb3fe865821cb352606522987fb2cfed2856e1

Download Submit