e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe
Size

1012KB
MD5

d22bb120046d20cc90406cd6590808f7
SHA1

2c781179917ac59a87a3a77ac36d3d6369cc6198
SHA256

e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6
SHA512

7e7c0a38c89c2aaa3b82a2d39db1b913b1b78177b7179f26f42a953fa400be8e1c1269ae97a80dc7eab2beda6221b655ec47142930db4ebf918df8e95d704e15
SSDEEP

24576:jeMJ/lV3wE2OrqVMU4jOF1V139Hxa/ZSC77Lv+f6T8E:jbJ/lFwE22qFbVpLghbD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Loads dropped DLL 1 IoCs

pid	Process
2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2696	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2696	2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe	30
PID 2580 wrote to memory of 2696	2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe	30
PID 2580 wrote to memory of 2696	2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe	30
PID 2580 wrote to memory of 2696	2580	e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe	30

C:\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe
"C:\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe
  C:\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Filesize
1012KB

MD5
0a209ff680ec374e09588a736609e1d1

SHA1
e61d1ede32a7ee692b43803b42215104da6a7661

SHA256
973c43e38150cf328b432471b50e91cb13e46105d764e294daf9926301685ea5

SHA512
7b7ab748eaa059152e388394b78ea12f72bab43acec125d35fd4f70d9a5d0ca71c1ddf209359a55837352801eb36f845421a7e0e027591dc878e8224f30af276

Download Submit
\Users\Admin\AppData\Local\Temp\e0cfb56769b48fd3321eac183f30d151dd65636ea4df30809188dc5de6197da6.exe

Filesize
1012KB

MD5
0a209ff680ec374e09588a736609e1d1

SHA1
e61d1ede32a7ee692b43803b42215104da6a7661

SHA256
973c43e38150cf328b432471b50e91cb13e46105d764e294daf9926301685ea5

SHA512
7b7ab748eaa059152e388394b78ea12f72bab43acec125d35fd4f70d9a5d0ca71c1ddf209359a55837352801eb36f845421a7e0e027591dc878e8224f30af276

Download Submit
memory/2580-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2580-8-0x00000000030E0000-0x00000000031C5000-memory.dmp

Filesize
916KB

Download
memory/2580-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2696-10-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2696-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2696-12-0x0000000002EF0000-0x0000000002FD5000-memory.dmp

Filesize
916KB

Download
memory/2696-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2696-22-0x0000000007830000-0x00000000078D3000-memory.dmp

Filesize
652KB

Download