ffdafb18bfe62ce27a3f76b9425aaa2b6ea0640f4b408908e3f25b7502767e4e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

080fa9760df897b9ff3a71e2b72bdcdd.exe
Size

385KB
MD5

080fa9760df897b9ff3a71e2b72bdcdd
SHA1

13c151f19846f097ea40812edf16053b03bbd18a
SHA256

ffdafb18bfe62ce27a3f76b9425aaa2b6ea0640f4b408908e3f25b7502767e4e
SHA512

5295dae729df0b014d6107b253cc654fdd135f7275630303537a8fdbeb018f000a0b7d108fc608072f7700fa20f8ac0a2e3987229b049945a66c931f45291416
SSDEEP

12288:TuHo196F6rX3PzW5zVCah0tH/9Oh5rWILYRB:TuHo196F6rX3+sah0tH/9Oh5rWILYRB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1824	080fa9760df897b9ff3a71e2b72bdcdd.exe

Executes dropped EXE 1 IoCs

pid	Process
1824	080fa9760df897b9ff3a71e2b72bdcdd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4968	080fa9760df897b9ff3a71e2b72bdcdd.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4968	080fa9760df897b9ff3a71e2b72bdcdd.exe
1824	080fa9760df897b9ff3a71e2b72bdcdd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1824	4968	080fa9760df897b9ff3a71e2b72bdcdd.exe	89
PID 4968 wrote to memory of 1824	4968	080fa9760df897b9ff3a71e2b72bdcdd.exe	89
PID 4968 wrote to memory of 1824	4968	080fa9760df897b9ff3a71e2b72bdcdd.exe	89

C:\Users\Admin\AppData\Local\Temp\080fa9760df897b9ff3a71e2b72bdcdd.exe
"C:\Users\Admin\AppData\Local\Temp\080fa9760df897b9ff3a71e2b72bdcdd.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\080fa9760df897b9ff3a71e2b72bdcdd.exe
  C:\Users\Admin\AppData\Local\Temp\080fa9760df897b9ff3a71e2b72bdcdd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\080fa9760df897b9ff3a71e2b72bdcdd.exe

Filesize
137KB

MD5
82615e34afb5e59e38b0577c660524db

SHA1
6e1f163bc80537ad4482b90052243bc22100ef0c

SHA256
b665270dfd47247748feffb82b62186876dcee009e8bb97db195e29552919c65

SHA512
e7b9359659da67b0d776f113ed896bd412a6a81a24ef3fe5e7fe1f97398d40814702d06ba412557e45860e2a934ec941968f73dbd2f5d2d13fdece91312d8890

Download Submit
memory/1824-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1824-15-0x0000000001630000-0x0000000001696000-memory.dmp

Filesize
408KB

Download
memory/1824-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/1824-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1824-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1824-35-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/1824-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4968-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4968-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4968-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4968-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download