a0ac02a1e6c908b90173e86c3e321f2bab082ed45236503a21eb7d984de10611

Analysis

max time kernel
40s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 02:13

Target

main_bin.exe
Size

165KB
MD5

a84e1256111e4e235250a8e3bb11f903
SHA1

1b76e5a645a0df61bb4569d54bd1183ab451c95e
SHA256

a0ac02a1e6c908b90173e86c3e321f2bab082ed45236503a21eb7d984de10611
SHA512

27d26faf85b32e58a5a1ecd391c7f6c4cb1dbd494a8fd66369652c26a89c4a1eeae7124696b41cd851b5e5e787d3aabd67a1f656001d0e509018fbb414667ab2
SSDEEP

3072:eOFEQVKT/M/j2kX7qyAuLRpsPvpXmo0WTfG3PzoNE9cXh6yrfDop4B13:3FnA02kguLR4mo0CfG3LoicXh6q7y4BJ

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 5116	4104	main_bin.exe	86
PID 3568 set thread context of 4284	3568	svchost.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	main_bin.exe
5116	main_bin.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 4104 wrote to memory of 5116	4104	main_bin.exe	86
PID 5116 wrote to memory of 3568	5116	main_bin.exe	87
PID 5116 wrote to memory of 3568	5116	main_bin.exe	87
PID 5116 wrote to memory of 3568	5116	main_bin.exe	87
PID 5116 wrote to memory of 3568	5116	main_bin.exe	87
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96
PID 3568 wrote to memory of 4284	3568	svchost.exe	96

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/3568-4-0x0000000000900000-0x0000000000918000-memory.dmp

Filesize
96KB

Download
memory/3568-25-0x0000000000900000-0x0000000000918000-memory.dmp

Filesize
96KB

Download
memory/4284-21-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-18-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-19-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-20-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-22-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-23-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-24-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4284-26-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5116-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5116-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5116-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5116-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5116-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download