512f4e391f2c99a528cbc858a75325d0acc80156ca575fe8ea5f0df6e20f29a8

Analysis

max time kernel
140s
max time network
169s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25/02/2025, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDAPro_9.0_Setup_&_Crack/patcher.exe
Size

5.4MB
MD5

4f02273679acc5106434155362a08d97
SHA1

66f26df0891466b6bc050219faa050f66b5e896f
SHA256

95c3e515f6b82307f42bda326b354154f2ad0a0752ccab404f2b22ca9e14748f
SHA512

d61e5bdb6316a37c1b33641a32ee434dc4847cbe8ebfa5f30ddaef563ea79fdd0e9e50f5f9ff8b6d3bc879e741b1a4df02b1e09ecd8797c1bb26aad80f2a4835
SSDEEP

98304:AB5+0iZJ8i4nSJPwYmFvKH+lwzIgH/Pf+XBRq732SIo4lkY7wtzqNS:ABAv5JPwYm1Ke98/eXbi7JYktzqN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	main.exe

Loads dropped DLL 10 IoCs

pid	Process
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe
4356	main.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4356	main.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4356	2268	patcher.exe	81
PID 2268 wrote to memory of 4356	2268	patcher.exe	81
PID 4356 wrote to memory of 3260	4356	main.exe	82
PID 4356 wrote to memory of 3260	4356	main.exe	82
PID 4356 wrote to memory of 4416	4356	main.exe	98
PID 4356 wrote to memory of 4416	4356	main.exe	98
PID 4356 wrote to memory of 1232	4356	main.exe	99
PID 4356 wrote to memory of 1232	4356	main.exe	99

C:\Users\Admin\AppData\Local\Temp\IDAPro_9.0_Setup_&_Crack\patcher.exe
"C:\Users\Admin\AppData\Local\Temp\IDAPro_9.0_Setup_&_Crack\patcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\main.exe
  C:\Users\Admin\AppData\Local\Temp\IDAPro_9.0_Setup_&_Crack\patcher.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
75KB

MD5
0f5e64e33f4d328ef11357635707d154

SHA1
8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

SHA256
8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

SHA512
4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\_ctypes.pyd

Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\_pytransform.dll

Filesize
1.1MB

MD5
9b7305ff340df63df458c042e230b101

SHA1
4ad59df8c02cd349ff1672e716fcea4cf117b36b

SHA256
ba24c351d3feeb62b3e844456e8e00ee08459607520dd775774db1293ca25e78

SHA512
f16a811c07f161e0ebe4daa208b82d1732ce8df06b3f3278730e09478f4aaea85bdae7535a1f899765145fa974c34aed3d091917e06b237e3f0d7fec85ff7a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\main.exe

Filesize
4.3MB

MD5
19557d731513a724f1b5f6c6abc398b8

SHA1
b3e2086bac75822294a953992990e3a2994fab5e

SHA256
939af5518ee764d2ac3d7c4391045e766538cfac1c584f70d0880484fd3e5cf4

SHA512
871f6e65e9a91798ad11ba511a2cd18acb973a9824847675f376c72f4aad0104a4bd89ecc7a36daa59ff1d0d8712c3756001e47e82b319b087c606617f7e4399

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\pytransform.pyd

Filesize
448KB

MD5
deee6a1faba231d735aade8f644c4444

SHA1
e52880cc66fac3415ff1bb4b38e0f567dce8514b

SHA256
2f860451d6539200195b55a666493280ee52f6e4602d32da2c7c17502c0ab5b6

SHA512
57ab8f8f357be99db5e9f4d2cad22d60201889033b769ee702787681856d03f72543eb386be83f66bd1e68c55564538f95452cab97ab6d5bb8eb5d35af55e7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2268_133849544651535245\select.pyd

Filesize
28KB

MD5
c119811a40667dca93dfe6faa418f47a

SHA1
113e792b7dcec4366fc273e80b1fc404c309074c

SHA256
8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

SHA512
107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

Download Submit
memory/4356-69-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-57-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-89-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-87-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-85-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-83-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-81-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-79-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-77-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-75-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-71-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-93-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-67-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-65-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-63-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-61-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-59-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-91-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-55-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-53-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-51-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-49-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-47-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-45-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-43-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-41-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-39-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-37-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-36-0x000001917F430000-0x000001917F431000-memory.dmp

Filesize
4KB

Download
memory/4356-95-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-97-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-99-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download
memory/4356-73-0x000001917F440000-0x000001917F441000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads