9b1990880d6a8ac0d751c81d346843c03d218ff9bf90c820e9bfd331fdb404e9

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

179d8b4e4a72bf323d076d2283ada986.exe
Size

385KB
MD5

179d8b4e4a72bf323d076d2283ada986
SHA1

cafa6ec95608920883f9b7a04582fa6099521148
SHA256

9b1990880d6a8ac0d751c81d346843c03d218ff9bf90c820e9bfd331fdb404e9
SHA512

8fef184454482a5969006c3d262c79bd0903524aeb204ba5881bcbb87b395b41c0f43c1f65a5a6c10a64196706bd3303a00fd838f6daec097e015bfb71952289
SSDEEP

6144:Nc8KbTgeHqR6t3AFVZFv7c6j2R5EmKblrvM/wBQb+RHSgJKQfJWCB:NheHKBZF1YZIlSPwHSgJdfJWCB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3692	179d8b4e4a72bf323d076d2283ada986.exe

Executes dropped EXE 1 IoCs

pid	Process
3692	179d8b4e4a72bf323d076d2283ada986.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4276	179d8b4e4a72bf323d076d2283ada986.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4276	179d8b4e4a72bf323d076d2283ada986.exe
3692	179d8b4e4a72bf323d076d2283ada986.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3692	4276	179d8b4e4a72bf323d076d2283ada986.exe	92
PID 4276 wrote to memory of 3692	4276	179d8b4e4a72bf323d076d2283ada986.exe	92
PID 4276 wrote to memory of 3692	4276	179d8b4e4a72bf323d076d2283ada986.exe	92

C:\Users\Admin\AppData\Local\Temp\179d8b4e4a72bf323d076d2283ada986.exe
"C:\Users\Admin\AppData\Local\Temp\179d8b4e4a72bf323d076d2283ada986.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\179d8b4e4a72bf323d076d2283ada986.exe
  C:\Users\Admin\AppData\Local\Temp\179d8b4e4a72bf323d076d2283ada986.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\179d8b4e4a72bf323d076d2283ada986.exe

Filesize
385KB

MD5
009e0528bb768fd8707c067b60f9e91c

SHA1
4c33419c6d2ae1a05cec67593524960d079c6ed0

SHA256
a9f0c7a2957f755fb0d0a14e901bf1f25d4fc327d2eb6fb764c3a0cb4ca8b961

SHA512
389efdc88266a32cb2bbca36c3cf3b30afddec7f467c12dc9ce889c7d7336bd7f8dae05ce8cb6957756a27404ce9d6f17ffbf0a4456b2455956479295029e6af

Download Submit
memory/3692-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3692-15-0x0000000000170000-0x00000000001D6000-memory.dmp

Filesize
408KB

Download
memory/3692-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/3692-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3692-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3692-32-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/3692-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4276-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4276-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4276-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4276-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download