3f06623c6bd14fe58a5960f012f032bf3169372be5070ad4354dc4f7ab887f60

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1930f3a0fda2a5d7010efac55c551d8c.exe
Size

907KB
MD5

1930f3a0fda2a5d7010efac55c551d8c
SHA1

232ae3f0aa7cd3063bfcf807528e9013dda7cc70
SHA256

3f06623c6bd14fe58a5960f012f032bf3169372be5070ad4354dc4f7ab887f60
SHA512

84c6200bfe20fca1c0fb1d3e6ee126ec7912f37c8ba2970c953a87e52583bcfd41e85b5498cc9604826e7fde49102727be78d46533b0760e1392ab0fe796adec
SSDEEP

12288:CL7Zog6XqiTdLyD6jmvRXXYakAyyqShS1iE9oJGRCcM1FjVDa/ZS1:20X/Aei5XYavyyFhS1iE6JeS17a/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1528	1930f3a0fda2a5d7010efac55c551d8c.exe

Executes dropped EXE 1 IoCs

pid	Process
1528	1930f3a0fda2a5d7010efac55c551d8c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3492	1930f3a0fda2a5d7010efac55c551d8c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3492	1930f3a0fda2a5d7010efac55c551d8c.exe
1528	1930f3a0fda2a5d7010efac55c551d8c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1528	3492	1930f3a0fda2a5d7010efac55c551d8c.exe	93
PID 3492 wrote to memory of 1528	3492	1930f3a0fda2a5d7010efac55c551d8c.exe	93
PID 3492 wrote to memory of 1528	3492	1930f3a0fda2a5d7010efac55c551d8c.exe	93

C:\Users\Admin\AppData\Local\Temp\1930f3a0fda2a5d7010efac55c551d8c.exe
"C:\Users\Admin\AppData\Local\Temp\1930f3a0fda2a5d7010efac55c551d8c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\1930f3a0fda2a5d7010efac55c551d8c.exe
  C:\Users\Admin\AppData\Local\Temp\1930f3a0fda2a5d7010efac55c551d8c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1930f3a0fda2a5d7010efac55c551d8c.exe

Filesize
907KB

MD5
997f50beb6c70ccffd7c08255c518fe6

SHA1
7f10e6d0ca9a73b030e4c838cbb9a9c172bd0b01

SHA256
8b4ecb9dcbb367d015e68069fab0954fb1e002d4a4f8c03104e8dd0567bef33c

SHA512
72951ebe3863bb3277a208191c344329b9d4c8c5d5060e0177a26dc982b2d69d6cf72e33e69a763a436b955c4cb9f206b8ea3858626ebf028aa9fd6c52f9ce45

Download Submit
memory/1528-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1528-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1528-20-0x00000000051F0000-0x00000000052AB000-memory.dmp

Filesize
748KB

Download
memory/1528-18-0x00000000017F0000-0x00000000018D8000-memory.dmp

Filesize
928KB

Download
memory/1528-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1528-38-0x000000000C820000-0x000000000C8B8000-memory.dmp

Filesize
608KB

Download
memory/3492-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3492-1-0x00000000015B0000-0x0000000001698000-memory.dmp

Filesize
928KB

Download
memory/3492-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3492-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download