Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\_mei25882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
- %TEMP%\_mei25882\vcruntime140.dll
- %TEMP%\_mei25882\vcruntime140_1.dll
- %TEMP%\_mei25882\_asyncio.pyd
- %TEMP%\_mei25882\_bz2.pyd
- %TEMP%\_mei25882\_cffi_backend.cp314-win_amd64.pyd
- %TEMP%\_mei25882\_ctypes.pyd
- %TEMP%\_mei25882\_decimal.pyd
- %TEMP%\_mei25882\_hashlib.pyd
- %TEMP%\_mei25882\_lzma.pyd
- %TEMP%\_mei25882\_multiprocessing.pyd
- %TEMP%\_mei25882\_overlapped.pyd
- %TEMP%\_mei25882\_queue.pyd
- %TEMP%\_mei25882\_socket.pyd
- %TEMP%\_mei25882\_sqlite3.pyd
- %TEMP%\_mei25882\_ssl.pyd
- %TEMP%\_mei25882\_wmi.pyd
- %TEMP%\_mei25882\_zstd.pyd
- %TEMP%\_mei25882\base_library.zip
- %TEMP%\_mei25882\certifi\cacert.pem
- %TEMP%\_mei25882\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei25882\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\installer
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\metadata
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\record
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\wheel
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25882\libcrypto-3.dll
- %TEMP%\_mei25882\libffi-8.dll
- %TEMP%\_mei25882\libssl-3.dll
- %TEMP%\_mei25882\pyexpat.pyd
- %TEMP%\_mei25882\python3.dll
- %TEMP%\_mei25882\python314.dll
- %TEMP%\_mei25882\select.pyd
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei25882\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei25882\sqlite3.dll
- %TEMP%\_mei25882\unicodedata.pyd
- %TEMP%\wuauclt.bat
- nul
- %TEMP%\cook_chrome_tmp.db
- %TEMP%\br_chrome_tmp.db
- %TEMP%\br_edge_tmp.db
Deletes following files that it created itself
- %TEMP%\wuauclt.bat
- %TEMP%\_mei25882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
- %TEMP%\_mei25882\certifi\cacert.pem
- %TEMP%\_mei25882\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei25882\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\installer
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.apache
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.bsd
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\metadata
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\record
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\sbom.json
- %TEMP%\_mei25882\cryptography-49.0.0.dist-info\wheel
- %TEMP%\_mei25882\libcrypto-3.dll
- %TEMP%\_mei25882\libffi-8.dll
- %TEMP%\_mei25882\libssl-3.dll
- %TEMP%\_mei25882\pyexpat.pyd
- %TEMP%\_mei25882\python3.dll
- %TEMP%\_mei25882\python314.dll
- %TEMP%\_mei25882\select.pyd
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei25882\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei25882\sqlite3.dll
- %TEMP%\_mei25882\unicodedata.pyd
- %TEMP%\_mei25882\vcruntime140.dll
- %TEMP%\_mei25882\vcruntime140_1.dll
- %TEMP%\_mei25882\_asyncio.pyd
- %TEMP%\_mei25882\_bz2.pyd
- %TEMP%\_mei25882\_cffi_backend.cp314-win_amd64.pyd
- %TEMP%\_mei25882\_ctypes.pyd
- %TEMP%\_mei25882\_decimal.pyd
- %TEMP%\_mei25882\_hashlib.pyd
- %TEMP%\_mei25882\_lzma.pyd
- %TEMP%\_mei25882\_multiprocessing.pyd
- %TEMP%\_mei25882\_overlapped.pyd
- %TEMP%\_mei25882\_queue.pyd
- %TEMP%\_mei25882\_socket.pyd
- %TEMP%\_mei25882\_sqlite3.pyd
- %TEMP%\_mei25882\_ssl.pyd
- %TEMP%\_mei25882\_wmi.pyd
- %TEMP%\_mei25882\_zstd.pyd
- %TEMP%\cook_chrome_tmp.db
- %TEMP%\br_chrome_tmp.db
- %TEMP%\br_edge_tmp.db
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di##ord.com':443
TCP
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c %TEMP%\wuauclt.bat
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c "netsh wlan show profiles"
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh wlan show profiles"' (with hidden window)
