Overview

overview

10

Static

static

10

c29f43cd92...da.exe

windows7-x64

7

c29f43cd92...da.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2025, 06:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c29f43cd9249c6c87a0dcdf849c0e2da.exe
  • Size 1.2MB
  • Sample250227-g9qvmsyth1
  • SHA256 1a5da09e281f4a2acadf791cbad426351a769d2b8057005b1415e74a7ddfb0af
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistencepyinstallerspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c29f43cd9249c6c87a0dcdf849c0e2da.exe
    "C:\Users\Admin\AppData\Local\Temp\c29f43cd9249c6c87a0dcdf849c0e2da.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\temp_24135.exe
      "C:\Users\Admin\AppData\Local\Temp\temp_24135.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Users\Admin\AppData\Local\Temp\temp_24135.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_24135.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4416
    • C:\Users\Admin\AppData\Local\Temp\temp_24174.exe
      "C:\Users\Admin\AppData\Local\Temp\temp_24174.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4124

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\VCRUNTIME140.dll
        • Size 87KB
        • SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_bz2.pyd
        • Size 82KB
        • SHA256 c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_ctypes.pyd
        • Size 120KB
        • SHA256 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_hashlib.pyd
        • Size 44KB
        • SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_lzma.pyd
        • Size 246KB
        • SHA256 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\_socket.pyd
        • Size 77KB
        • SHA256 587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-console-l1-1-0.dll
        • Size 19KB
        • SHA256 f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-datetime-l1-1-0.dll
        • Size 19KB
        • SHA256 7e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-debug-l1-1-0.dll
        • Size 19KB
        • SHA256 990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 19KB
        • SHA256 a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-file-l1-1-0.dll
        • Size 22KB
        • SHA256 5d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-file-l1-2-0.dll
        • Size 19KB
        • SHA256 2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-file-l2-1-0.dll
        • Size 19KB
        • SHA256 0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-handle-l1-1-0.dll
        • Size 19KB
        • SHA256 f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-heap-l1-1-0.dll
        • Size 19KB
        • SHA256 63fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 19KB
        • SHA256 6a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 19KB
        • SHA256 84c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-memory-l1-1-0.dll
        • Size 19KB
        • SHA256 9ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 19KB
        • SHA256 2695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 20KB
        • SHA256 5660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 6781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 19KB
        • SHA256 4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-profile-l1-1-0.dll
        • Size 18KB
        • SHA256 c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 19KB
        • SHA256 4b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-string-l1-1-0.dll
        • Size 19KB
        • SHA256 f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-synch-l1-2-0.dll
        • Size 19KB
        • SHA256 b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 20KB
        • SHA256 286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-timezone-l1-1-0.dll
        • Size 19KB
        • SHA256 05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-core-util-l1-1-0.dll
        • Size 19KB
        • SHA256 8aca888849e9089a3a56fa867b16b071951693ab886843cfb61bd7a5b08a1ece
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-conio-l1-1-0.dll
        • Size 20KB
        • SHA256 f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-convert-l1-1-0.dll
        • Size 23KB
        • SHA256 08a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-environment-l1-1-0.dll
        • Size 19KB
        • SHA256 5af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-heap-l1-1-0.dll
        • Size 20KB
        • SHA256 735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-locale-l1-1-0.dll
        • Size 19KB
        • SHA256 89d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-process-l1-1-0.dll
        • Size 20KB
        • SHA256 7e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 23KB
        • SHA256 fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 1eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\api-ms-win-crt-utility-l1-1-0.dll
        • Size 19KB
        • SHA256 88d3918e2f063553cee283306365aa8701e60fb418f37763b4719f9974f07477
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\base_library.zip
        • Size 821KB
        • SHA256 b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\libffi-7.dll
        • Size 32KB
        • SHA256 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\python38.dll
        • Size 4.0MB
        • SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\select.pyd
        • Size 26KB
        • SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\ucrtbase.dll
        • Size 1021KB
        • SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI32122\unicodedata.pyd
        • Size 1.0MB
        • SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        temp_24135.exe
        • Path C:\Users\Admin\AppData\Local\Temp\temp_24135.exe
        • Size 5.6MB
        • SHA256 d29f12ad00ae702fb9d2fd8518e6aa996e15e0c57136611967fc18088d55a886
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        temp_24174.exe
        • Path C:\Users\Admin\AppData\Local\Temp\temp_24174.exe
        • Size 175KB
        • SHA256 72dfbf863d182353ffec9e17ed6bdc86cd42b8a9d8fc09db2935278d91f855cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download