9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14-11-2023 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe
Size

2.0MB
MD5

80cc9106f8ab6224329eb4052710bb64
SHA1

45e785a11ea81910c1b7c04d9749807f9c4ca5ea
SHA256

9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2
SHA512

2030e53a66d5bc8dcadc6fddbadf727b378e3304ad5a431345139593edd8cf79e0fa6768fe5d85fb40d4ff895e530767ae88beb367ec8af433768706dfc14813
SSDEEP

24576:nfVkcS63uV/BMoLUojCEONB8csa/ZSC77Lv+f6T8Qnskb2i6OBKaBudep+dnsa/1:fVnSyuV5L1jG8csghbq4TTow+lsghbD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2300	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Loads dropped DLL 1 IoCs

pid	Process
1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2300	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2300	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2300	1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe	29
PID 1864 wrote to memory of 2300	1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe	29
PID 1864 wrote to memory of 2300	1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe	29
PID 1864 wrote to memory of 2300	1864	9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe	29

C:\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe
"C:\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe
  C:\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Filesize
2.0MB

MD5
5f65a268b23b0e431a8d4b87d633e578

SHA1
26cf434568f7ab4a5b71c33edb44be1975fca451

SHA256
cefd9a64124dbc0dae718b05c5a1ba985f6963653d4fd9976e957a07736da301

SHA512
44b2a3fdd05e910ab9d7f7a5f3d94290f10b6342d8a0f0588fe257549796981fa4841024e0465c9b0b385abe38dbdd4ba64ce2ea3ce771bfb4c4f3a82621fd6e

Download Submit
\Users\Admin\AppData\Local\Temp\9111a33d540a5de55a2cd86c937c29878d7368e2242de686dcfbf124d10531e2.exe

Filesize
2.0MB

MD5
5f65a268b23b0e431a8d4b87d633e578

SHA1
26cf434568f7ab4a5b71c33edb44be1975fca451

SHA256
cefd9a64124dbc0dae718b05c5a1ba985f6963653d4fd9976e957a07736da301

SHA512
44b2a3fdd05e910ab9d7f7a5f3d94290f10b6342d8a0f0588fe257549796981fa4841024e0465c9b0b385abe38dbdd4ba64ce2ea3ce771bfb4c4f3a82621fd6e

Download Submit
memory/1864-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1864-6-0x0000000002E20000-0x0000000002F05000-memory.dmp

Filesize
916KB

Download
memory/1864-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2300-10-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2300-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2300-12-0x0000000002E70000-0x0000000002F55000-memory.dmp

Filesize
916KB

Download
memory/2300-18-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-22-0x0000000007670000-0x0000000007713000-memory.dmp

Filesize
652KB

Download