48fe545d10166c4aea48252deab4a043abd56b758aed8439a5f1479d18ae6944

Resubmissions

31-12-2024 03:26

241231-dzfp5ssjer 7

31-12-2024 03:23

241231-dxrpmavmfy 7

31-12-2024 03:22

241231-dxckps1rgj 7

31-12-2024 03:18

241231-dt4j1s1qgj 7

Analysis

max time kernel
427s
max time network
443s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-12-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nueva carpeta/python-3.13.1-amd64.exe
Size

27.4MB
MD5

90176c0cfa29327ab08c6083dcdcc210
SHA1

cc0bcf37414be313526d63ef708fc85da3b693b1
SHA256

6b33fa9a439a86f553f9f60e538ccabc857d2f308bc77c477c04a46552ade81f
SHA512

5940aae44386f3622dee3f32e6a98073851a9f646da6bf3e04f050b9a9239e0ddf50b26e5e125154edc5bbebce7353d273950f1111e4ca5f2b4e2e4a7ac7cf92
SSDEEP

786432:fKScWFPQmn8ZNPeBvm1+MS3gpir9K8X+a:CcJQS8aBvm16gpGvX+a

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4152	python-3.13.1-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
4152	python-3.13.1-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4152	python-3.13.1-amd64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.1-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.1-amd64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4152	1984	python-3.13.1-amd64.exe	81
PID 1984 wrote to memory of 4152	1984	python-3.13.1-amd64.exe	81
PID 1984 wrote to memory of 4152	1984	python-3.13.1-amd64.exe	81

C:\Users\Admin\AppData\Local\Temp\Nueva carpeta\python-3.13.1-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\Nueva carpeta\python-3.13.1-amd64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Temp\{2CA4C2E3-8638-435F-88F0-7FF94EAE11E4}\.cr\python-3.13.1-amd64.exe
  "C:\Windows\Temp\{2CA4C2E3-8638-435F-88F0-7FF94EAE11E4}\.cr\python-3.13.1-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Nueva carpeta\python-3.13.1-amd64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=536
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{01768FFD-D13F-40D9-84E5-E83D6DA7F93D}\.ba\PythonBA.dll

Filesize
692KB

MD5
e8cd5641cae8ae7e9f98b8a3b7096808

SHA1
dd587894cad3122c1719def17f8377bb2bbbc05e

SHA256
898474ad4074571813416e58667a3b8a233e12e656579726c178ec71f794b268

SHA512
53034732df45527389362c2cc53d3ba0390bc4c1a7700b7d61d774d1eecdfed43381311c63b38861215813a674eb3fe865821cb352606522987fb2cfed2856e1

Download Submit
C:\Windows\Temp\{01768FFD-D13F-40D9-84E5-E83D6DA7F93D}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{2CA4C2E3-8638-435F-88F0-7FF94EAE11E4}\.cr\python-3.13.1-amd64.exe

Filesize
878KB

MD5
9bc2cfce73fe043e69c909fb1546dbbf

SHA1
8ee81917775b4bd60ea0592b2203d2219dc98cfa

SHA256
ba89d23a7c937c05feba316a927773faaf7becfb2279d9edac6cc11e31205e29

SHA512
4243b3923b998b21ed386750b179bf29bda164d6154e2f5cd744b361963c4e1025ed3d6d557f1cad672818a909cc8a5036cf14ccf4f5bdd1284db24156ad58e7

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads