c9da3969931b59d99a6b21cfabd2677c6c58b848d0a6b19b8c1a9112a2e61e21

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c8368db627fc2772484d28c8685eb99.exe
Size

6.8MB
MD5

1c8368db627fc2772484d28c8685eb99
SHA1

3850f2b066c1df55c70d63b6d89eb6854fb24df1
SHA256

c9da3969931b59d99a6b21cfabd2677c6c58b848d0a6b19b8c1a9112a2e61e21
SHA512

6e25b79aad59b0ad43ea855ccbeb343dfc51310d9a56ef10dbc6654cff80c2546a87213aed3c09fb524a448aa3d1fc54ae99b9a63933fd3e1ab2c52aee436393
SSDEEP

196608:OJoCz3uizalBzSTIj5JvIe7Vs9oxUDXj8jGphb:YuPzRBIe7VB8T3l

Score

7^/10

discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2640	final986987.exe
2952	final986987.exe

Loads dropped DLL 4 IoCs

pid	Process
2412	1c8368db627fc2772484d28c8685eb99.exe
2400	Process not Found
2640	final986987.exe
2952	final986987.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000d00000001202c-3.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c8368db627fc2772484d28c8685eb99.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2640	2412	1c8368db627fc2772484d28c8685eb99.exe	30
PID 2412 wrote to memory of 2640	2412	1c8368db627fc2772484d28c8685eb99.exe	30
PID 2412 wrote to memory of 2640	2412	1c8368db627fc2772484d28c8685eb99.exe	30
PID 2412 wrote to memory of 2640	2412	1c8368db627fc2772484d28c8685eb99.exe	30
PID 2640 wrote to memory of 2952	2640	final986987.exe	33
PID 2640 wrote to memory of 2952	2640	final986987.exe	33
PID 2640 wrote to memory of 2952	2640	final986987.exe	33

C:\Users\Admin\AppData\Local\Temp\1c8368db627fc2772484d28c8685eb99.exe
"C:\Users\Admin\AppData\Local\Temp\1c8368db627fc2772484d28c8685eb99.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\final986987.exe
  "C:\Users\Admin\AppData\Local\Temp\final986987.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\final986987.exe
    "C:\Users\Admin\AppData\Local\Temp\final986987.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26402\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
\Users\Admin\AppData\Local\Temp\final986987.exe

Filesize
6.6MB

MD5
ef12eb5be4046a8d70e864d3b623bb2d

SHA1
cf28f12a882cd8dfa1b280c2254013a7908d1984

SHA256
e5cf853398bcdd00fa6925a007cb7683e61d35c11ec641da44c419fd66d66dab

SHA512
89c7b5eb7170c58d80b893cbe4e65556f6b8a640321fe390c8c3acd13e2ae786ea9462a6b1db8342fbc107e1575a7dd84051f2aefd6baf94be360bf818d68d4d

Download Submit