3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de | Triage

Submit
Reports

Overview

overview

Static

static

XPloit.zip

windows7-x64

3

XPloit.zip

windows10-2004-x64

1

ForlornApi.dll

windows7-x64

1

ForlornApi.dll

windows10-2004-x64

1

ForlornInject.dll

windows7-x64

1

ForlornInject.dll

windows10-2004-x64

7

XPloit.deps.json

windows7-x64

3

XPloit.deps.json

windows10-2004-x64

3

XPloit.exe

windows7-x64

XPloit.exe

windows10-2004-x64

XPloit.exe

windows7-x64

XPloit.exe

windows10-2004-x64

main.pyc

windows7-x64

3

main.pyc

windows10-2004-x64

3

XPloit.pdb

windows7-x64

3

XPloit.pdb

windows10-2004-x64

3

XPloit.run...g.json

windows7-x64

3

XPloit.run...g.json

windows10-2004-x64

3

workspace/IY_FE.iy

windows7-x64

3

workspace/IY_FE.iy

windows10-2004-x64

3

workspace/...s.json

windows7-x64

3

workspace/...s.json

windows10-2004-x64

3

Resubmissions

21-12-2024 17:42

241221-v9y3xavlaz 10

20-12-2024 23:19

241220-3bbtqawpat 10

20-12-2024 19:29

241220-x7fjwssqdm 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 17:42

Sharing

Static task

static1

vmprotect pyinstaller sazan darkcomet empyrean

6 signatures

Behavioral task

behavioral1

Sample

XPloit.zip

Resource

win7-20240903-en

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

XPloit.zip

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

ForlornApi.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

ForlornApi.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

ForlornInject.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

ForlornInject.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

XPloit.deps.json

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral8

Sample

XPloit.deps.json

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

XPloit.exe

Resource

win7-20240708-en

darkcomet sazan discovery pyinstaller rat trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral10

Sample

XPloit.exe

Resource

win10v2004-20241007-en

darkcomet sazan discovery persistence pyinstaller rat spyware stealer trojan upx

windows10-2004-x64

20 signatures

150 seconds

Behavioral task

behavioral11

Sample

XPloit.exe

Resource

win7-20241010-en

darkcomet sazan discovery pyinstaller rat trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral12

Sample

XPloit.exe

Resource

win10v2004-20241007-en

darkcomet sazan discovery persistence pyinstaller rat spyware stealer trojan upx

windows10-2004-x64

20 signatures

150 seconds

Behavioral task

behavioral13

Sample

main.pyc

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral14

Sample

main.pyc

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

XPloit.pdb

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral16

Sample

XPloit.pdb

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

XPloit.runtimeconfig.json

Resource

win7-20241023-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral18

Sample

XPloit.runtimeconfig.json

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

workspace/IY_FE.iy

Resource

win7-20241010-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral20

Sample

workspace/IY_FE.iy

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

workspace/MercurySettings.json

Resource

win7-20240903-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral22

Sample

workspace/MercurySettings.json

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

ForlornApi.dll
Size

13KB
MD5

e31fc5f539332de2888121b098d0d5d2
SHA1

2c76b76bc2a4bd3ce49394a15687dfd6835aa46d
SHA256

0bef874d8dab4fcf8024227ccc870ed7f6fb9c6d5db0ffe5d447948c26c3cad8
SHA512

70db518de1567fd297fe8d4a9a3bf68ab7d7b3c2cdb9358dc84ec2213313aa3d4bb831453044662fdc82d87cc9f34344109bbd4ba91c500ef797f99e7bc55564
SSDEEP

192:EZRcjJAwd3EUkgrUlGaHIofKbCkWNgF3anfm+eN6J+2uan1WVqG0siS1ag9:+EGuQpHAgN3aNqlWVjyrg9

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ForlornApi.dll,#1
1⤵
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy