c4cbe2085eb5c538971dda9a2b789b904120dd128def616b40179599bb90d663

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

142a2d3dea2882c789d495d510e8aff9.exe
Size

385KB
MD5

142a2d3dea2882c789d495d510e8aff9
SHA1

5dbeeddcb8000690097115dc432696a0c6ddaba8
SHA256

c4cbe2085eb5c538971dda9a2b789b904120dd128def616b40179599bb90d663
SHA512

cbbbca91ca88eb96045ea2fa9387615de7544cdf32f0bd28f9af25d5453f012f6e9f1dfc98e176b7d2c5ebd28a968236547fbe3bde3c476bc966f90497b8b439
SSDEEP

6144:EbSJtTwaqtBY2ueUeli9W7EJWjrCIQmxWatnAJR4AHYlBNpOrXMtC+nB:EbSJmS2Cz93Wrz5xtWXHmBqgB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3612	142a2d3dea2882c789d495d510e8aff9.exe

Executes dropped EXE 1 IoCs

pid	Process
3612	142a2d3dea2882c789d495d510e8aff9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1548	142a2d3dea2882c789d495d510e8aff9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1548	142a2d3dea2882c789d495d510e8aff9.exe
3612	142a2d3dea2882c789d495d510e8aff9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3612	1548	142a2d3dea2882c789d495d510e8aff9.exe	91
PID 1548 wrote to memory of 3612	1548	142a2d3dea2882c789d495d510e8aff9.exe	91
PID 1548 wrote to memory of 3612	1548	142a2d3dea2882c789d495d510e8aff9.exe	91

C:\Users\Admin\AppData\Local\Temp\142a2d3dea2882c789d495d510e8aff9.exe
"C:\Users\Admin\AppData\Local\Temp\142a2d3dea2882c789d495d510e8aff9.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\142a2d3dea2882c789d495d510e8aff9.exe
  C:\Users\Admin\AppData\Local\Temp\142a2d3dea2882c789d495d510e8aff9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\142a2d3dea2882c789d495d510e8aff9.exe

Filesize
156KB

MD5
a48b9851bb23f9f7559eeed507861738

SHA1
75ec43f4917048676284348b9574db7785eefd21

SHA256
dcd0401504430270a67990e72b9d0439aaaa123b91534ddd8a9fd34ebadfc59a

SHA512
07129cab2477ff8053ace1e71787deb766a0d95f00be8b67d7b0ef5262f5ff7cea9b9c5ebe5c3376a26ee7ea9e269c8b07e0af93c8f2bb14128d45ebf3c93ad5

Download Submit
memory/1548-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1548-1-0x0000000000140000-0x00000000001A6000-memory.dmp

Filesize
408KB

Download
memory/1548-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1548-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3612-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3612-17-0x00000000015E0000-0x0000000001646000-memory.dmp

Filesize
408KB

Download
memory/3612-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3612-20-0x0000000004F20000-0x0000000004F7F000-memory.dmp

Filesize
380KB

Download
memory/3612-33-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/3612-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3612-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download