Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei54602\vcruntime140.dll
- %TEMP%\_mei54602\_asyncio.pyd
- %TEMP%\_mei54602\_bz2.pyd
- %TEMP%\_mei54602\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei54602\_ctypes.pyd
- %TEMP%\_mei54602\_decimal.pyd
- %TEMP%\_mei54602\_hashlib.pyd
- %TEMP%\_mei54602\_lzma.pyd
- %TEMP%\_mei54602\_multiprocessing.pyd
- %TEMP%\_mei54602\_overlapped.pyd
- %TEMP%\_mei54602\_queue.pyd
- %TEMP%\_mei54602\_socket.pyd
- %TEMP%\_mei54602\_ssl.pyd
- %TEMP%\_mei54602\base_library.zip
- %TEMP%\_mei54602\certifi\cacert.pem
- %TEMP%\_mei54602\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei54602\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\installer
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\metadata
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\record
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\wheel
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license.apache
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license.bsd
- %TEMP%\_mei54602\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei54602\libcrypto-3-x64.dll
- %TEMP%\_mei54602\libcrypto-3.dll
- %TEMP%\_mei54602\libffi-8.dll
- %TEMP%\_mei54602\libssl-3.dll
- %TEMP%\_mei54602\ossl-modules\legacy.dll
- %TEMP%\_mei54602\pyexpat.pyd
- %TEMP%\_mei54602\python3.dll
- %TEMP%\_mei54602\python311.dll
- %TEMP%\_mei54602\select.pyd
- %TEMP%\_mei54602\unicodedata.pyd
- %TEMP%\_mei60362\vcruntime140.dll
- %TEMP%\_mei60362\_asyncio.pyd
- %TEMP%\_mei60362\_bz2.pyd
- %TEMP%\_mei60362\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei60362\_ctypes.pyd
- %TEMP%\_mei60362\_decimal.pyd
- %TEMP%\_mei60362\_hashlib.pyd
- %TEMP%\_mei60362\_lzma.pyd
- %TEMP%\_mei60362\_multiprocessing.pyd
- %TEMP%\_mei60362\_overlapped.pyd
- %TEMP%\_mei60362\_queue.pyd
- %TEMP%\_mei60362\_socket.pyd
- %TEMP%\_mei60362\_ssl.pyd
- %TEMP%\_mei60362\base_library.zip
- %TEMP%\_mei60362\certifi\cacert.pem
- %TEMP%\_mei60362\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei60362\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\installer
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\metadata
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\record
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\wheel
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\licenses\license
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\licenses\license.apache
- %TEMP%\_mei60362\cryptography-46.0.2.dist-info\licenses\license.bsd
- %TEMP%\_mei60362\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei60362\libcrypto-3-x64.dll
- %TEMP%\_mei60362\libcrypto-3.dll
- %TEMP%\_mei60362\libffi-8.dll
- %TEMP%\_mei60362\libssl-3.dll
- %TEMP%\_mei60362\ossl-modules\legacy.dll
- %TEMP%\_mei60362\pyexpat.pyd
- %TEMP%\_mei60362\python3.dll
- %TEMP%\_mei60362\python311.dll
- %TEMP%\_mei60362\select.pyd
- %TEMP%\_mei60362\unicodedata.pyd
Удаляет файлы, которые сам же создал
- %TEMP%\_mei54602\base_library.zip
- %TEMP%\_mei54602\certifi\cacert.pem
- %TEMP%\_mei54602\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei54602\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei54602\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\installer
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license.apache
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\licenses\license.bsd
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\metadata
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\record
- %TEMP%\_mei54602\cryptography-46.0.2.dist-info\wheel
- %TEMP%\_mei54602\libcrypto-3-x64.dll
- %TEMP%\_mei54602\libcrypto-3.dll
- %TEMP%\_mei54602\libffi-8.dll
- %TEMP%\_mei54602\libssl-3.dll
- %TEMP%\_mei54602\ossl-modules\legacy.dll
- %TEMP%\_mei54602\pyexpat.pyd
- %TEMP%\_mei54602\python3.dll
- %TEMP%\_mei54602\python311.dll
- %TEMP%\_mei54602\select.pyd
- %TEMP%\_mei54602\unicodedata.pyd
- %TEMP%\_mei54602\vcruntime140.dll
- %TEMP%\_mei54602\_asyncio.pyd
- %TEMP%\_mei54602\_bz2.pyd
- %TEMP%\_mei54602\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei54602\_ctypes.pyd
- %TEMP%\_mei54602\_decimal.pyd
- %TEMP%\_mei54602\_hashlib.pyd
- %TEMP%\_mei54602\_lzma.pyd
- %TEMP%\_mei54602\_multiprocessing.pyd
- %TEMP%\_mei54602\_overlapped.pyd
- %TEMP%\_mei54602\_queue.pyd
- %TEMP%\_mei54602\_socket.pyd
- %TEMP%\_mei54602\_ssl.pyd
Самоперемещается
- из <Полный путь к файлу> в C:\services and system infrastructure host.exe
Сетевая активность
Подключается к
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- '1e########86-38-49.ngrok-free.app':443
TCP
Другие
- '1e########86-38-49.ngrok-free.app':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK 1e########86-38-49.ngrok-free.app
Другое
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
