Analysis
-
max time kernel
159s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:52
Behavioral task
behavioral1
Sample
autodl.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
autodl.exe
Resource
win10v2004-20240226-en
General
-
Target
autodl.exe
-
Size
6.2MB
-
MD5
09746c29829d3897e8826aab170a5ee0
-
SHA1
a7d095d8ba2dbc2ba6f57c18ac556fd229876b82
-
SHA256
f3b943cdd0a10ec3b8409157953c10f91e77a82c49c9d1b5487246779ccf34fd
-
SHA512
6bba57bbe93336dd1fd5bf833c30446229035913167c431cbaa6acbea4ef2f031acdd01ac6a17e8c27fcceff0933173550a552062d5ee2be35a52db61ca79f01
-
SSDEEP
196608:euH+eL2Vmd6+DgTNfwZHYYDgMJV/kd04V:VeeL2Vmd6mgBk0MJVs
Malware Config
Signatures
-
Loads dropped DLL 15 IoCs
Processes:
autodl.exepid process 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe 4204 autodl.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
autodl.exeautodl.exedescription pid process target process PID 3112 wrote to memory of 4204 3112 autodl.exe autodl.exe PID 3112 wrote to memory of 4204 3112 autodl.exe autodl.exe PID 4204 wrote to memory of 5020 4204 autodl.exe cmd.exe PID 4204 wrote to memory of 5020 4204 autodl.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\autodl.exe"C:\Users\Admin\AppData\Local\Temp\autodl.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\autodl.exe"C:\Users\Admin\AppData\Local\Temp\autodl.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\VCRUNTIME140.dllFilesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_bz2.pydFilesize
78KB
MD5d61719bf7f3d7cdebdf6c846c32ddaca
SHA1eda22e90e602c260834303bdf7a3c77ab38477d0
SHA25631dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
SHA512e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_ctypes.pydFilesize
117KB
MD53fc444a146f7d667169dcb4f48760f49
SHA1350a1300abc33aa7ca077daba5a883878a3bca19
SHA256b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
SHA5121609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_hashlib.pydFilesize
60KB
MD50d75220cf4691af4f97ebcbd9a481c62
SHA1dadc3d5476c83668a715750ed80176dbbb536ec7
SHA2569da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
SHA512c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_lzma.pydFilesize
151KB
MD5afff5db126034438405debadb4b38f08
SHA1fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
SHA25675d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
SHA5123334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_queue.pydFilesize
27KB
MD5c8a1f1dc297b6dd10c5f7bc64f907d38
SHA1be0913621e5ae8b04dd0c440ee3907da9cf6eb72
SHA256827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
SHA512e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_socket.pydFilesize
74KB
MD5f59ddb8b1eeac111d6a003f60e45b389
SHA1e4e411a10c0ad4896f8b8153b826214ed8fe3caa
SHA2569558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
SHA512873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\_ssl.pydFilesize
153KB
MD580f2475d92ad805439d92cba6e657215
SHA120aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
SHA25641278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
SHA512618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\base_library.zipFilesize
812KB
MD5b9b9099700058ac1f5b213de7af18f36
SHA1672247fcb5a6b7ccd9833e267788ab5fe63e0440
SHA2568c9d1d6e2a999c8df81e25ff7822ba7c8a88f5bff2acaab338460e3624239265
SHA51277f33ab55ceb5aa13b2bd0e0f68a786153de4310b2924f68d0d3c1be5fe382d4b95ee89f93cab71cfa3c79f8f3b2103c234e3b95242fe3d32ccdd76e2261421c
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\libcrypto-1_1.dllFilesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\libffi-7.dllFilesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\libssl-1_1.dllFilesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\python310.dllFilesize
4.2MB
MD5e9c0fbc99d19eeedad137557f4a0ab21
SHA18945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA2565783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
SHA51274e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\select.pydFilesize
26KB
MD5994a6348f53ceea82b540e2a35ca1312
SHA18d764190ed81fd29b554122c8d3ae6bf857e6e29
SHA256149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
SHA512b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
-
C:\Users\Admin\AppData\Local\Temp\_MEI31122\unicodedata.pydFilesize
1.1MB
MD5c01a5ce36dd1c822749d8ade8a5e68ca
SHA1a021d11e1eb7a63078cbc3d3e3360d6f7e120976
SHA2560f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
SHA5123d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38