c029a8fdc745bd6a9e487f884eaeed4a42ab5349f38dda165669fd3391e3f7d7

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09540b757c8b98b6a163adea15ba2bf3.exe
Size

771KB
MD5

09540b757c8b98b6a163adea15ba2bf3
SHA1

5e18479092e18f3e1f725a8d6be48bdc4588b36a
SHA256

c029a8fdc745bd6a9e487f884eaeed4a42ab5349f38dda165669fd3391e3f7d7
SHA512

cb54080b370637ac9b36da910b7cbd04142d3a95621c7d9603e5674e94ff35983c12bfa9330e05c8ef6a4a56b68c3affea5e71fa6409fe1fed394632b5f98d71
SSDEEP

24576:+SsIkFs1VUSlNGB3VBk0b10hJaothZ2/T6FBBB:7USCB3bZ/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
224	09540b757c8b98b6a163adea15ba2bf3.exe

Executes dropped EXE 1 IoCs

pid	Process
224	09540b757c8b98b6a163adea15ba2bf3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3596	09540b757c8b98b6a163adea15ba2bf3.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3596	09540b757c8b98b6a163adea15ba2bf3.exe
224	09540b757c8b98b6a163adea15ba2bf3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 224	3596	09540b757c8b98b6a163adea15ba2bf3.exe	21
PID 3596 wrote to memory of 224	3596	09540b757c8b98b6a163adea15ba2bf3.exe	21
PID 3596 wrote to memory of 224	3596	09540b757c8b98b6a163adea15ba2bf3.exe	21

C:\Users\Admin\AppData\Local\Temp\09540b757c8b98b6a163adea15ba2bf3.exe
"C:\Users\Admin\AppData\Local\Temp\09540b757c8b98b6a163adea15ba2bf3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\09540b757c8b98b6a163adea15ba2bf3.exe
  C:\Users\Admin\AppData\Local\Temp\09540b757c8b98b6a163adea15ba2bf3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-15-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/224-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/224-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/224-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/224-33-0x000000000B700000-0x000000000B73C000-memory.dmp

Filesize
240KB

Download
memory/224-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/224-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3596-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3596-1-0x0000000001540000-0x00000000015A6000-memory.dmp

Filesize
408KB

Download
memory/3596-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3596-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download