325046bc8a7d2539b624b03fc99c890b21637fced778dfc9732fb45399be76a1

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynapseX.exe
Size

42.9MB
MD5

7b3d941aea08723c7d37ebacef5fc9c3
SHA1

ff63cbef47d0dbaa4613bd805ab277063fd71001
SHA256

325046bc8a7d2539b624b03fc99c890b21637fced778dfc9732fb45399be76a1
SHA512

89d36a7fde032004787035d89c38e217083bad894e924f3d93a84ab01c45713e3b809f9a37f4784dbee42eb671fc33f5b18f4cab1c28085b33ca003094ba41ae
SSDEEP

786432:J6/0dbuzcY876N6Z6Zi6/9x9ta9eyq8OThzvcdpJ0q8TPZUd3GfuebvemvnDAV3s:o/0diE7pOiYweyJulZUdgbeEkV37U

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
3328	SynapseX.exe
3328	SynapseX.exe
3328	SynapseX.exe
3328	SynapseX.exe
3328	SynapseX.exe
3328	SynapseX.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023ba2-159.dat	upx
behavioral2/memory/3328-163-0x00007FFEF0DF0000-0x00007FFEF14B5000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-167.dat	upx
behavioral2/files/0x000c000000023b7b-166.dat	upx
behavioral2/memory/3328-192-0x00007FFF09A60000-0x00007FFF09A6F000-memory.dmp	upx
behavioral2/files/0x000a000000023b7e-193.dat	upx
behavioral2/memory/3328-194-0x00007FFF05FB0000-0x00007FFF05FC4000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-195.dat	upx
behavioral2/memory/3328-196-0x00007FFEF08C0000-0x00007FFEF0DE9000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-191.dat	upx
behavioral2/files/0x000a000000023b85-190.dat	upx
behavioral2/files/0x000a000000023b84-189.dat	upx
behavioral2/files/0x000a000000023b83-188.dat	upx
behavioral2/files/0x000a000000023b82-187.dat	upx
behavioral2/files/0x000a000000023b81-186.dat	upx
behavioral2/files/0x000a000000023b80-185.dat	upx
behavioral2/files/0x000a000000023b7f-184.dat	upx
behavioral2/files/0x000a000000023b7d-182.dat	upx
behavioral2/files/0x000a000000023b7c-181.dat	upx
behavioral2/files/0x0008000000023ad5-180.dat	upx
behavioral2/files/0x0008000000023ad4-179.dat	upx
behavioral2/files/0x0007000000023cd3-177.dat	upx
behavioral2/files/0x0007000000023cd2-176.dat	upx
behavioral2/files/0x0007000000023cbc-175.dat	upx
behavioral2/files/0x000b000000023ba1-174.dat	upx
behavioral2/files/0x000a000000023b8c-173.dat	upx
behavioral2/files/0x000a000000023b8b-172.dat	upx
behavioral2/memory/3328-168-0x00007FFF006A0000-0x00007FFF006C5000-memory.dmp	upx
behavioral2/memory/3328-201-0x00007FFEF08C0000-0x00007FFEF0DE9000-memory.dmp	upx
behavioral2/memory/3328-200-0x00007FFF05FB0000-0x00007FFF05FC4000-memory.dmp	upx
behavioral2/memory/3328-199-0x00007FFF09A60000-0x00007FFF09A6F000-memory.dmp	upx
behavioral2/memory/3328-198-0x00007FFF006A0000-0x00007FFF006C5000-memory.dmp	upx
behavioral2/memory/3328-197-0x00007FFEF0DF0000-0x00007FFEF14B5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3328	4180	SynapseX.exe	84
PID 4180 wrote to memory of 3328	4180	SynapseX.exe	84

C:\Users\Admin\AppData\Local\Temp\SynapseX.exe
"C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\SynapseX.exe
  "C:\Users\Admin\AppData\Local\Temp\SynapseX.exe"
  2⤵
  - Loads dropped DLL
  PID:3328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI41802\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_asyncio.pyd

Filesize
37KB

MD5
d9f56d51d32bcbade2d954a9427337dc

SHA1
d0e5cee77d5038193580335e3271bb5f1fb6bfc4

SHA256
1b6c23b6f235ad58e4062b1dc4ce2c36f031f1469bf9e60c11e07603ca4656e3

SHA512
fc18968a319c11b2d9f20a376b93cc74503139506b1c9f9ee3dd226edc1ba753cad85c20368e162c14d26cf2f75f70ae7e82b2b9881088235f5eaca66e8dad66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_bz2.pyd

Filesize
48KB

MD5
9da23eb807a43a954d40048b53a98e6f

SHA1
e639bd9a27409fc72f36b4ec3383eeecdacb9dc5

SHA256
02d0d3c0163f69a7e6713742ab98e73321c5298976089fe9a03b6d91d3293ebb

SHA512
c8d164c8d4722dcd04f13aa11307fddd655e73fd03b15c8056b34252bce925ca679b48032313b8587369500d03574213da20e513c3b4c155099a84de9ac0bba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_ctypes.pyd

Filesize
59KB

MD5
78f5225e986641eaebfe2bef27865603

SHA1
118ac80fdf764f5bfbaad2d803420087b854817d

SHA256
ae55ad9ad1f4cbc398cd0c87556f1f263505cde025c7c7f2c43ce4ae818eb183

SHA512
70e18ea660120d60d6bfa17883c2aced276aa858c5da4dca1e1d56203891d996da4f349596c911cb16497db81b42af4ad85e473c3e80f8932557d967c9dad0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_decimal.pyd

Filesize
107KB

MD5
c67548fec576c79aa4c7d829ebbcb8fd

SHA1
3c1dd3daf407257ded9717dadcf017fdd8a2c07c

SHA256
31c2c5200f59969c7078a5a913067dfcdf326cb0d43754e38893239774286fab

SHA512
696d76f6baf739aa2a0d1d057df6d3f8cba1008c0528c8060bb3808a775393bf5e61578154e0d1bd0f3162195b108fbe51daf005d29d368447b5c8fe844a338b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_elementtree.pyd

Filesize
59KB

MD5
22fc5be528d33809cbb192b065cbbb05

SHA1
a15379c180f7fd2970eb37dda69f1961df4bbfc8

SHA256
8987b547d08c762fa665e28636f14d205dbcd3e599fad0beaf7607ef4c3477a8

SHA512
b0a9c62f962e0c2a7d7f37f63f4b39eb64fe884266d88990343cfbbb145d3cfa76332ca6f996a31f912fecc448173acfb08792a22940779403cc99216d699f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_hashlib.pyd

Filesize
35KB

MD5
121f21e4c072b1307ec96e26dbb54f48

SHA1
fd7ffeb22377db68bd6abce8ea526afa14faad0f

SHA256
8dac9aa352bfcb960501682d412a9eeebea5d1cdde3771ba9b70a0ae2e08e883

SHA512
bec606d0b9c4cabc263a4eda3b8cd403e2486a4e3369fe99117386c4d1969248c54d762b465ab5bdf87fdcc7a08bf90aa873064c65063db8cd4dc437e7e1e6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_lzma.pyd

Filesize
86KB

MD5
24a598b2caa17caee2e24d2bb97b445d

SHA1
262f07406e170284fea0c1e41093bfe1c4a25eab

SHA256
af4ae25b17c7cf23d06e1f37fdefe903a840073266d4314e410a4acec2af6270

SHA512
7bdf0a599c488436c118523a67ab154a37ffc5aab0ecec95c463bd068d1121b197c0ebb91dc7db3cf2a3db913abaffd0a60aedb373c0e670c63cd8d85f716f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_multiprocessing.pyd

Filesize
27KB

MD5
3cba83d3acab104d0237ca3fd0fda954

SHA1
6fd08494729a6f3bef6b908365268bdac1e170f1

SHA256
a50471d9a065b2e4f0fa61fb88c2dcaa04b7f104fae9ea4bc981d0f6fe39e5fc

SHA512
09105f6e6ad13d8d89ef81f9d8c6273c0c540d29227d653d3e3a86d210030b1737f3779839088bc3ea1e08aaf2de70cf55d5288f34b7441bfbd8999a33b6e2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_overlapped.pyd

Filesize
33KB

MD5
ab8d1617e9c0c43c1683a567498c1441

SHA1
69ee6500c1bb30b437693283075165dec0861433

SHA256
7779b8fc61da810db720956b3d49c0d1c8cd4e05cc662f767fc8f0088cf923d4

SHA512
f1f79c4499b135c56eef659b82fc46e3869519c1adf0704c0e5fab34f593c741549c236c0c62610f4c9ee2ea10e9acbccb39474a518b66f41c84b3466c133b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_queue.pyd

Filesize
26KB

MD5
52e8135f08c61f94b536d1a1c787bf23

SHA1
6ea0d2bd42d3293273b27ea5fb64abef3361ba3f

SHA256
fdcd6416bcbaddc8d0e3b029d2c5f621956066cb95c5fa06c948e7eec25152b8

SHA512
06e75181a0831d1493ecc28a02f2f52fd30c1b53a4053e94a974b577ace6cdc912f1cb7223059cdacecf5fabfff1f2fff2955b1ba8f54ce5b15b7a6eec77c452

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_socket.pyd

Filesize
44KB

MD5
886d68f020a8a2232fbcb8ab431ff9f8

SHA1
65db84d574e9e38281475cb6d86acb94c74ce5b9

SHA256
199c490b67f4364a78c6ba7df595e13e483e110345d067bf57b3826d3bf06715

SHA512
bb33bb67ee0204817282373f72a2666aa32e8e47a717e443247bd493853f804949bb59ae3b4a213fcad306d1ced123cd1377e05df3e353400120928597ed34da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_sqlite3.pyd

Filesize
57KB

MD5
4381c00145ed565ed992f415aa4e33da

SHA1
378be370c2290e9d6a9dee406f989c211cf0efe2

SHA256
d81d61074ed8a476af01a46eefb32a908eb8ab34f7cf7d4f53dcfd8274a163be

SHA512
57b527e0a2f55c45e1aaee147adb67933b6f6acd5f8eebe6efe97fc5f8c23f20a1303972b45076565d0bff880b751fc039a85673ee88a77a17f969e17ec0a3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_ssl.pyd

Filesize
66KB

MD5
e5353f0aa2c35efd5b4a1a0805a6978c

SHA1
d92f1066fe79dc1a1afe7ca3c0b9e803aced7e9f

SHA256
908a3938b962132f3f4429badad0e26a8b138de192a060ca1c1067e2b2ce128a

SHA512
11c632e69c982a77053fefb22e764dfdb30f6d10abe6c88e2512aa7daf26a0ef59dcc109d262cdb58875f2fba46312027b6e180dc7f0fa24ddc02b78a55c0c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\_wmi.pyd

Filesize
28KB

MD5
9ba21832765a278dfc220426e9c6a2e3

SHA1
b82716b165f3094b70e41a01b4785ca1b1e2c2de

SHA256
aa23361fc26c1b91fcc458156eeca0ee869c6f9eca30182ceb2b83c810cfaab4

SHA512
a9232b7593c29543091c0f7d1043cc1b39ff0b7c324362fe860d3ee0674ca069c93a85d0a8c2bb6133904318f67e448c1fd99e491f0ddda57d8d9f984ed106a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\base_library.zip

Filesize
1.3MB

MD5
242a4d3404414a9e8ed1ca1a72e8039c

SHA1
b1fd68d13cc6d5b97dc3ea8e2be1144ea2c3ed50

SHA256
cb98f93ede1f6825699ef6e5f11a65b00cdbc9fdfb34f7209b529a6e43e0402d

SHA512
cca8e18cc41300e204aee9e44d68ffe9808679b7dbf3bec9b3885257cadccff1df22a3519cc8db3b3c557653c98bac693bf89a1e6314ef0e0663c76be2bf8626

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\crypto_clipper.json

Filesize
155B

MD5
8bff94a9573315a9d1820d9bb710d97f

SHA1
e69a43d343794524b771d0a07fd4cb263e5464d5

SHA256
3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7

SHA512
d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\libcrypto-3.dll

Filesize
1.6MB

MD5
63eb76eccfe70cff3a3935c0f7e8ba0f

SHA1
a8dd05dce28b79047e18633aee5f7e68b2f89a36

SHA256
785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

SHA512
8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\libffi-8.dll

Filesize
29KB

MD5
be8ceb4f7cb0782322f0eb52bc217797

SHA1
280a7cc8d297697f7f818e4274a7edd3b53f1e4d

SHA256
7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

SHA512
07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\libopus-0.x64.dll

Filesize
217KB

MD5
e56f1b8c782d39fd19b5c9ade735b51b

SHA1
3d1dc7e70a655ba9058958a17efabe76953a00b4

SHA256
fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732

SHA512
b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\libssl-3.dll

Filesize
222KB

MD5
7e87c34b39f3a8c332df6e15fd83160b

SHA1
db712b55f23d8e946c2d91cbbeb7c9a78a92b484

SHA256
41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

SHA512
eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\pyexpat.pyd

Filesize
88KB

MD5
cfcb1a1159cc2aadba3c62ac44dc2363

SHA1
e19df1a6c3dfa545c6b2c20355b24584933d7f9f

SHA256
279aac95d765000d7b3b09b75e66a311a03833a0e28361683cf41161f37e3331

SHA512
f7f42bc3eb6a2db706f784e2b772c3ce5d0f87b4b3ff6bda6d2f934aecce0174d52623aad0a082dd1efc0f70c990a07fa9768ac96d42ddb52ea5be594198b447

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\python312.dll

Filesize
1.7MB

MD5
ca67f0baf3cc3b7dbb545cda57ba3d81

SHA1
5b4e36aef877307af8a8f78f3054d068d1a9ce89

SHA256
f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3

SHA512
a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\select.pyd

Filesize
25KB

MD5
6c123b56f3a37c129eff6fc816868b25

SHA1
ac6b6e3bdc53870ba044a38b9ae9a067b70e7641

SHA256
99687f9b1648ac684dfb7937c75e3e50dc16704abd4c4c19601c40ec6971c5ee

SHA512
b840871278a6cc32d5ab0cc6d9c129da0ba2d08b93c3c6c000e3989fe1ab8b09ed82ca547a1057690f52f22e44b203f424e2ccd9655be82a1094547a94ddc3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\sqlite3.dll

Filesize
644KB

MD5
132614956f138f3594d1053e3fac4779

SHA1
95115f866a87db308ff00af0273e04e31a3fdaae

SHA256
2a4ae8ca681fa6f8de3b6dbcc3d32652ea3ab3ee7e2be80b7aff822a382ca8ff

SHA512
5b12b51c78bd72f410e2f53c086322557591d9d66b6d473264fa731763ec2317470009c13cbb9d0985c9006c7f62c4eed14c263295bd7ef11db0bc492c2ca5a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41802\unicodedata.pyd

Filesize
296KB

MD5
3d5cb46d212da9843d199f6989b37cd5

SHA1
ce5e427d49ea1adba9c941140f3502c969b6819e

SHA256
50a55bc145b1f43e5125ef0b09e508946221d02d5fea1b7550a43d8c8c41c970

SHA512
c52014c96578db4c7f97878a13ca8c2a4574cc6671689bb554382ad0e593eb87fac55961c7c11ef82b04627fb851ac44848bac9ec91fca0afaa965e4f1f24aa5

Download Submit
memory/3328-192-0x00007FFF09A60000-0x00007FFF09A6F000-memory.dmp

Filesize
60KB

Download
memory/3328-196-0x00007FFEF08C0000-0x00007FFEF0DE9000-memory.dmp

Filesize
5.2MB

Download
memory/3328-194-0x00007FFF05FB0000-0x00007FFF05FC4000-memory.dmp

Filesize
80KB

Download
memory/3328-163-0x00007FFEF0DF0000-0x00007FFEF14B5000-memory.dmp

Filesize
6.8MB

Download
memory/3328-168-0x00007FFF006A0000-0x00007FFF006C5000-memory.dmp

Filesize
148KB

Download
memory/3328-201-0x00007FFEF08C0000-0x00007FFEF0DE9000-memory.dmp

Filesize
5.2MB

Download
memory/3328-200-0x00007FFF05FB0000-0x00007FFF05FC4000-memory.dmp

Filesize
80KB

Download
memory/3328-199-0x00007FFF09A60000-0x00007FFF09A6F000-memory.dmp

Filesize
60KB

Download
memory/3328-198-0x00007FFF006A0000-0x00007FFF006C5000-memory.dmp

Filesize
148KB

Download
memory/3328-197-0x00007FFEF0DF0000-0x00007FFEF14B5000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads