049f1a56ba069fc36b89abf331e8af4f8e11880a72810eb28faecaea0cb6f26a

Analysis

max time kernel
150s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07cf7c4db78f52d6b2434b009849d833.exe
Size

771KB
MD5

07cf7c4db78f52d6b2434b009849d833
SHA1

a576e97519e92d989fa20977266e0cf8d929c239
SHA256

049f1a56ba069fc36b89abf331e8af4f8e11880a72810eb28faecaea0cb6f26a
SHA512

184ca5e206f8aa05e7378f376e6e1087edaadab7ac217410ccf943d685e040a4aacb2a49a71346869a201c65bcab00fce989aadee85d7e1a1327ce0b791ef1f2
SSDEEP

24576:cvMikgSc4/G0A5ldrb10hJaothZ2/T6FBBB:cdkgSrCD/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3868	07cf7c4db78f52d6b2434b009849d833.exe

Executes dropped EXE 1 IoCs

pid	Process
3868	07cf7c4db78f52d6b2434b009849d833.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1520	07cf7c4db78f52d6b2434b009849d833.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1520	07cf7c4db78f52d6b2434b009849d833.exe
3868	07cf7c4db78f52d6b2434b009849d833.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3868	1520	07cf7c4db78f52d6b2434b009849d833.exe	91
PID 1520 wrote to memory of 3868	1520	07cf7c4db78f52d6b2434b009849d833.exe	91
PID 1520 wrote to memory of 3868	1520	07cf7c4db78f52d6b2434b009849d833.exe	91

C:\Users\Admin\AppData\Local\Temp\07cf7c4db78f52d6b2434b009849d833.exe
"C:\Users\Admin\AppData\Local\Temp\07cf7c4db78f52d6b2434b009849d833.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\07cf7c4db78f52d6b2434b009849d833.exe
  C:\Users\Admin\AppData\Local\Temp\07cf7c4db78f52d6b2434b009849d833.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\07cf7c4db78f52d6b2434b009849d833.exe

Filesize
223KB

MD5
49fca50baa213d8480265eadd7612f7f

SHA1
e1a09a66cad513b9caad3adbccb2228bd15f4f77

SHA256
b2901fe07c128a3057ac939b3d15e625a83c544fe0bc119c1739422e89ef88c9

SHA512
352735300c4364033b30b483047f60febafeaabdd8b251b76b5273ff3e70416750ac68a326280a116c83114ac30f9724ff56c9618a6c81e2ec654fb9d596a3d1

Download Submit
memory/1520-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1520-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1520-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1520-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3868-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3868-20-0x0000000004E90000-0x0000000004EEF000-memory.dmp

Filesize
380KB

Download
memory/3868-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3868-16-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3868-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3868-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3868-35-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download