f51b5d485f93858c382f5bf8f40fe44efef64eb60c4181ea2f0f9e6c282e65e4

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

228595c0ef9d52dc581adfb8998d771d.exe
Size

385KB
MD5

228595c0ef9d52dc581adfb8998d771d
SHA1

a865a003042b80fee6a82e945b24654122a0947b
SHA256

f51b5d485f93858c382f5bf8f40fe44efef64eb60c4181ea2f0f9e6c282e65e4
SHA512

6495afbc3694000b4ea7313fee35a7edb37285c15bfebfa402f6fe4b58eeecdbe4ccc99740acc6143d4e8b1a607d1ccd6b0a05edf80f274a3c6b1a63f207d894
SSDEEP

6144:n4NmhJF4kh4DW0VfgEObs70SfuC5PX0e4GBmOnJpzjZWdNTtdzo6Ov5cgB:n4+FPj0x0b4V5m0vUBSjv5cgB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1284	228595c0ef9d52dc581adfb8998d771d.exe

Executes dropped EXE 1 IoCs

pid	Process
1284	228595c0ef9d52dc581adfb8998d771d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2384	228595c0ef9d52dc581adfb8998d771d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2384	228595c0ef9d52dc581adfb8998d771d.exe
1284	228595c0ef9d52dc581adfb8998d771d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1284	2384	228595c0ef9d52dc581adfb8998d771d.exe	89
PID 2384 wrote to memory of 1284	2384	228595c0ef9d52dc581adfb8998d771d.exe	89
PID 2384 wrote to memory of 1284	2384	228595c0ef9d52dc581adfb8998d771d.exe	89

C:\Users\Admin\AppData\Local\Temp\228595c0ef9d52dc581adfb8998d771d.exe
"C:\Users\Admin\AppData\Local\Temp\228595c0ef9d52dc581adfb8998d771d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\228595c0ef9d52dc581adfb8998d771d.exe
  C:\Users\Admin\AppData\Local\Temp\228595c0ef9d52dc581adfb8998d771d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\228595c0ef9d52dc581adfb8998d771d.exe

Filesize
385KB

MD5
1a5a2274c55e42211509b6a7b2fab042

SHA1
712cc8cab1636d13b575f67f2bbfb9a42da732f6

SHA256
14246018eec51a616360bf8c0f72f74f7f18222af0cae6b5a54726e32b7b711f

SHA512
af4c4a760051dc3aae691ef6621c1158d360c3fbd5e68a0a541a3def719eee3f474010ddfb46ea405a0355fed27bc0fd80b0b81babc4ba3ce18095b10e52433a

Download Submit
memory/1284-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1284-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1284-20-0x0000000001650000-0x00000000016AF000-memory.dmp

Filesize
380KB

Download
memory/1284-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1284-35-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/1284-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2384-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2384-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2384-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2384-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download