10a6bb8e15e265ca823be48918b7aec5aa3b2d04c7f3ee51916bb630ee5d3c5d

Analysis

max time kernel
2s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a3e2e788a948b1197d3ea5c49de90a9.exe
Size

907KB
MD5

1a3e2e788a948b1197d3ea5c49de90a9
SHA1

06e24e54b4b1ae5f39193bf27cc6f3655799d801
SHA256

10a6bb8e15e265ca823be48918b7aec5aa3b2d04c7f3ee51916bb630ee5d3c5d
SHA512

22ebf7c174dfc8dcee5788a216124cfdff8243211a113e60c3e485cb6b20205fec2d368fcecbaef35e3f45ea0b3fafbe619ccffac2fb76797491f66a89a733f2
SSDEEP

12288:hRST4W31Oune879hQw8t8EWJ8ocyzh32qaeXDW0Uupt8nyLmnsVcSvjVDa/ZS1:h4T4W31Tv3L/K2z1rS08yLmsVcCa/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2044	1a3e2e788a948b1197d3ea5c49de90a9.exe

Executes dropped EXE 1 IoCs

pid	Process
2044	1a3e2e788a948b1197d3ea5c49de90a9.exe

Loads dropped DLL 1 IoCs

pid	Process
2108	1a3e2e788a948b1197d3ea5c49de90a9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2108	1a3e2e788a948b1197d3ea5c49de90a9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2108	1a3e2e788a948b1197d3ea5c49de90a9.exe
2044	1a3e2e788a948b1197d3ea5c49de90a9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2044	2108	1a3e2e788a948b1197d3ea5c49de90a9.exe	15
PID 2108 wrote to memory of 2044	2108	1a3e2e788a948b1197d3ea5c49de90a9.exe	15
PID 2108 wrote to memory of 2044	2108	1a3e2e788a948b1197d3ea5c49de90a9.exe	15
PID 2108 wrote to memory of 2044	2108	1a3e2e788a948b1197d3ea5c49de90a9.exe	15

C:\Users\Admin\AppData\Local\Temp\1a3e2e788a948b1197d3ea5c49de90a9.exe
C:\Users\Admin\AppData\Local\Temp\1a3e2e788a948b1197d3ea5c49de90a9.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2044

C:\Users\Admin\AppData\Local\Temp\1a3e2e788a948b1197d3ea5c49de90a9.exe
"C:\Users\Admin\AppData\Local\Temp\1a3e2e788a948b1197d3ea5c49de90a9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1a3e2e788a948b1197d3ea5c49de90a9.exe

Filesize
907KB

MD5
9f5022f3e456aa4b97325c3cbd13a40a

SHA1
06b4499c4609e4ff7987b73e27ba28087bccf731

SHA256
276fe90378cba8669f6e318451ef7c44cffda0ad342484fc4dfc3719ad6dc536

SHA512
7bb2ace9ea70ce7673bb321bf86b355d6d1b37e067a82d54f4682f4b7e2cc197472105fb4624016dab672c22ae78c94a150c616ebbb20d9d7c3291d8549b40ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1309.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2044-17-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2044-20-0x0000000000290000-0x0000000000378000-memory.dmp

Filesize
928KB

Download
memory/2044-25-0x0000000002F00000-0x0000000002FBB000-memory.dmp

Filesize
748KB

Download
memory/2044-23-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2044-77-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2044-79-0x0000000007760000-0x00000000077F8000-memory.dmp

Filesize
608KB

Download
memory/2108-15-0x00000000031C0000-0x00000000032A8000-memory.dmp

Filesize
928KB

Download
memory/2108-14-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2108-2-0x00000000002D0000-0x00000000003B8000-memory.dmp

Filesize
928KB

Download
memory/2108-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2108-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download