ee486bee3bc23af4f8f44e886ce016b8d3cc1af33799567008736292d3f4a2b2

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f5892f93c0b7ecc2f50a45ecd947119.exe
Size

385KB
MD5

0f5892f93c0b7ecc2f50a45ecd947119
SHA1

cd9d8d8739310c0e36164b7694a22f124aff6a3c
SHA256

ee486bee3bc23af4f8f44e886ce016b8d3cc1af33799567008736292d3f4a2b2
SHA512

038790131d904f9ff8c950b56e79ea4e098f192d46210c81ffbe79192bc36147f2de31bc0820af0bdb3ae5097fa4c69f9e7d4164b3133c8e954e092bee07c63c
SSDEEP

12288:pW+HIRFTET2rm5ucP2DbA5qSuA9IM5npnB:pnoXS2ri5PoApuSn5B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1404	0f5892f93c0b7ecc2f50a45ecd947119.exe

Executes dropped EXE 1 IoCs

pid	Process
1404	0f5892f93c0b7ecc2f50a45ecd947119.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4864	0f5892f93c0b7ecc2f50a45ecd947119.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4864	0f5892f93c0b7ecc2f50a45ecd947119.exe
1404	0f5892f93c0b7ecc2f50a45ecd947119.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1404	4864	0f5892f93c0b7ecc2f50a45ecd947119.exe	24
PID 4864 wrote to memory of 1404	4864	0f5892f93c0b7ecc2f50a45ecd947119.exe	24
PID 4864 wrote to memory of 1404	4864	0f5892f93c0b7ecc2f50a45ecd947119.exe	24

C:\Users\Admin\AppData\Local\Temp\0f5892f93c0b7ecc2f50a45ecd947119.exe
"C:\Users\Admin\AppData\Local\Temp\0f5892f93c0b7ecc2f50a45ecd947119.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\0f5892f93c0b7ecc2f50a45ecd947119.exe
  C:\Users\Admin\AppData\Local\Temp\0f5892f93c0b7ecc2f50a45ecd947119.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0f5892f93c0b7ecc2f50a45ecd947119.exe

Filesize
265KB

MD5
f70a3d47b791c96a7984c42cf6ca7997

SHA1
511f8813e6dd6d07e7e3f28bba1742f90b460117

SHA256
ea7ea1db423f266a09014868e8cb88b4282c37cef53a8dad0bad1b1cd023f822

SHA512
ea08668e67d5bdf021480fc107ceb54f2536ce2caa8d5f4ac55faf90e6cd56a733ce64d2ebbefe2e1f446be65eb9be1a09c53216820489fcffa83cb3fc57fcd3

Download Submit
memory/1404-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1404-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1404-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1404-22-0x0000000001620000-0x000000000167F000-memory.dmp

Filesize
380KB

Download
memory/1404-36-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/1404-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1404-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4864-1-0x00000000015A0000-0x0000000001606000-memory.dmp

Filesize
408KB

Download
memory/4864-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4864-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4864-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download