Python.Stealer.1598

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei37922\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\installer
%TEMP%\_mei37922\select.pyd
%TEMP%\_mei37922\pywin32_system32\pywintypes38.dll
%TEMP%\_mei37922\pywin32_system32\pythoncom38.dll
%TEMP%\_mei37922\python38.dll
%TEMP%\_mei37922\pyexpat.pyd
%TEMP%\_mei37922\libssl-1_1.dll
%TEMP%\_mei37922\libffi-7.dll
%TEMP%\_mei37922\libcrypto-1_1.dll
%TEMP%\_mei37922\base_library.zip
%TEMP%\_mei37922\_ssl.pyd
%TEMP%\_mei37922\_sqlite3.pyd
%TEMP%\_mei37922\_socket.pyd
%TEMP%\_mei37922\_queue.pyd
%TEMP%\_mei37922\_multiprocessing.pyd
%TEMP%\_mei37922\_lzma.pyd
%TEMP%\_mei37922\_hashlib.pyd
%TEMP%\_mei37922\_decimal.pyd
%TEMP%\_mei37922\_ctypes.pyd
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\license
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\metadata
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\record
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\wheel
%HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240912\microsoftedgesettingsbackup.txt
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240912\schema.txt.~tmp
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240912\edb00001.log
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240912\spartan.edb
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810.exe.log
%TEMP%\tmpdeae.tmp
%TEMP%\tmpdd46.tmp
%HOMEPATH%\desktop\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810.exe
%TEMP%\t05sdf1i
%TEMP%\_mei37922\win32\win32wnet.pyd
%TEMP%\_mei37922\win32com\shell\shell.pyd
%TEMP%\_mei37922\win32\win32trace.pyd
%TEMP%\_mei37922\win32\win32crypt.pyd
%TEMP%\_mei37922\win32\win32api.pyd
%TEMP%\_mei37922\win32\_win32sysloader.pyd
%TEMP%\_mei37922\unicodedata.pyd
%TEMP%\_mei37922\sqlite3.dll
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\top_level.txt
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\entry_points.txt
%TEMP%\_mei37922\setuptools-56.0.0.dist-info\dependency_links.txt
%HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240912\protected - it is a violation of windows policy to modify\backup.dat
%TEMP%\_mei37922\_cffi_backend.cp38-win_amd64.pyd
%TEMP%\_mei37922\_bz2.pyd
%TEMP%\_mei37922\vcruntime140_1.dll
%TEMP%\_mei37922\crypto\hash\_blake2b.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_des.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei37922\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei37922\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei37922\crypto\cipher\_chacha20.pyd
%TEMP%\_mei37922\crypto\cipher\_salsa20.pyd
%TEMP%\_mei37922\crypto\cipher\_arc4.pyd
%TEMP%\_mei37922\crypto\hash\_blake2s.pyd
%TEMP%\_mei37922\crypto\hash\_md2.pyd
%TEMP%\_mei37922\crypto\hash\_md4.pyd
%TEMP%\_mei37922\crypto\hash\_md5.pyd
%TEMP%\_mei37922\pythonwin\win32ui.pyd
%TEMP%\_mei37922\pythonwin\mfc140u.dll
%TEMP%\_mei37922\crypto\util\_strxor.pyd
%TEMP%\_mei37922\crypto\util\_cpuid_c.pyd
%TEMP%\_mei37922\crypto\publickey\_x25519.pyd
%TEMP%\_mei37922\crypto\publickey\_ed448.pyd
%TEMP%\_mei37922\crypto\publickey\_ed25519.pyd
%TEMP%\_mei37922\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei37922\crypto\protocol\_scrypt.pyd
%TEMP%\_mei37922\crypto\hash\_poly1305.pyd
%TEMP%\_mei37922\crypto\math\_modexp.pyd
%TEMP%\_mei37922\crypto\hash\_keccak.pyd
%TEMP%\_mei37922\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei37922\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei37922\crypto\hash\_sha512.pyd
%TEMP%\_mei37922\crypto\hash\_sha384.pyd
%TEMP%\_mei37922\crypto\hash\_sha256.pyd
%TEMP%\_mei37922\crypto\hash\_sha224.pyd
%TEMP%\_mei37922\crypto\hash\_sha1.pyd
%TEMP%\_mei37922\crypto\hash\_ripemd160.pyd
%TEMP%\_mei37922\vcruntime140.dll
%HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240912\microsoftedgecookiesbackup.dat

Изменяет следующие файлы

%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
%LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log

Подменяет следующие файлы

%LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
%LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbtmp.log

Сетевая активность

UDP

DNS ASK store-images.s-microsoft.com
DNS ASK iecvlist.microsoft.com
DNS ASK ms#.com

Другое

Ищет следующие окна

ClassName: 'OleMainThreadWndClass' WindowName: ''

Создает и запускает на исполнение

'%HOMEPATH%\desktop\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810.exe'

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "start cmd.exe /K %HOMEPATH%\Desktop\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810.exe" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /K %HOMEPATH%\Desktop\2c5046d96a757f7d0e302c447a31934376a67ef0bbb291b4979ceb619e9c6810.exe
'%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
'<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer