de6d5e81b045dc9594c9c55f00d58a519f6ad994def322ff60c986e4ce818570

Analysis

max time kernel
134s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0667751a4f57e8f0631885fd19922fd0.exe
Size

907KB
MD5

0667751a4f57e8f0631885fd19922fd0
SHA1

c73d958eda8ade7830f5468dfcf5b783a6814b47
SHA256

de6d5e81b045dc9594c9c55f00d58a519f6ad994def322ff60c986e4ce818570
SHA512

2502384aeb9e93704b9ff3f69456266c0dff14737a476f9808dbe90e0a0893ce4971f2ee0a7341027c4fa2ad2c4b4c44b9e4d061014e4bc1a5f243619397047c
SSDEEP

12288:FA2HVOHgzNvmhhLYOtJ4CmCAgEqAzVFekFwiI+ZjkeRjVDa/ZS1:d1SgJvmT7mfgEqAqkGaa/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3144	0667751a4f57e8f0631885fd19922fd0.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	0667751a4f57e8f0631885fd19922fd0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4196	0667751a4f57e8f0631885fd19922fd0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4196	0667751a4f57e8f0631885fd19922fd0.exe
3144	0667751a4f57e8f0631885fd19922fd0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3144	4196	0667751a4f57e8f0631885fd19922fd0.exe	93
PID 4196 wrote to memory of 3144	4196	0667751a4f57e8f0631885fd19922fd0.exe	93
PID 4196 wrote to memory of 3144	4196	0667751a4f57e8f0631885fd19922fd0.exe	93

C:\Users\Admin\AppData\Local\Temp\0667751a4f57e8f0631885fd19922fd0.exe
"C:\Users\Admin\AppData\Local\Temp\0667751a4f57e8f0631885fd19922fd0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Users\Admin\AppData\Local\Temp\0667751a4f57e8f0631885fd19922fd0.exe
  C:\Users\Admin\AppData\Local\Temp\0667751a4f57e8f0631885fd19922fd0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0667751a4f57e8f0631885fd19922fd0.exe

Filesize
907KB

MD5
0d75e2e4a86ecbd63dcfc2badc89218d

SHA1
ff863748d8ad058aa54621c278fba2435b007dbd

SHA256
89b31257f022d75d50552b99fbfcf91a4147202c8307dca2ccf3c0937b131a3a

SHA512
c01d5262dbe9a2fd8609ab27cb5010f518b2c0af823beab1ab178be928c7ac1ad597680e3831a6b81a8182301916d76973a7f6d210d604e97245138d67292818

Download Submit
memory/3144-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3144-14-0x0000000001790000-0x0000000001878000-memory.dmp

Filesize
928KB

Download
memory/3144-20-0x0000000005160000-0x000000000521B000-memory.dmp

Filesize
748KB

Download
memory/3144-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3144-30-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3144-33-0x000000000B800000-0x000000000B898000-memory.dmp

Filesize
608KB

Download
memory/4196-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4196-1-0x0000000001790000-0x0000000001878000-memory.dmp

Filesize
928KB

Download
memory/4196-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4196-12-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download