12951d83aa4309a174cb4d2dae3cfacca7df3df054985730e2a98a880d423574

Analysis

max time kernel
142s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ace1ee66520ff285f004cbb0d7ae6af.exe
Size

907KB
MD5

2ace1ee66520ff285f004cbb0d7ae6af
SHA1

e4416b5a8efdc89309be44061c1e286a1820cba8
SHA256

12951d83aa4309a174cb4d2dae3cfacca7df3df054985730e2a98a880d423574
SHA512

04a59d27022abeba5df3956113ac1810b1b605e3bee65638cd99dc6cafaadcbae8f7c445c17f7739a10b306452c87b5d5ee34d145a414ef64d09b358d036176c
SSDEEP

12288:TOifJzscubzVjaDfCPg5oL4bi2iXVH9tp1VEjfRepFdhdG+in+X+eF2jVDa/ZS1:TO8zVUVeDfsIUPH7zeeN2+gGF0a/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
384	2ace1ee66520ff285f004cbb0d7ae6af.exe

Executes dropped EXE 1 IoCs

pid	Process
384	2ace1ee66520ff285f004cbb0d7ae6af.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4868	2ace1ee66520ff285f004cbb0d7ae6af.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4868	2ace1ee66520ff285f004cbb0d7ae6af.exe
384	2ace1ee66520ff285f004cbb0d7ae6af.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 384	4868	2ace1ee66520ff285f004cbb0d7ae6af.exe	26
PID 4868 wrote to memory of 384	4868	2ace1ee66520ff285f004cbb0d7ae6af.exe	26
PID 4868 wrote to memory of 384	4868	2ace1ee66520ff285f004cbb0d7ae6af.exe	26

C:\Users\Admin\AppData\Local\Temp\2ace1ee66520ff285f004cbb0d7ae6af.exe
"C:\Users\Admin\AppData\Local\Temp\2ace1ee66520ff285f004cbb0d7ae6af.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\2ace1ee66520ff285f004cbb0d7ae6af.exe
  C:\Users\Admin\AppData\Local\Temp\2ace1ee66520ff285f004cbb0d7ae6af.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/384-16-0x0000000001710000-0x00000000017F8000-memory.dmp

Filesize
928KB

Download
memory/384-20-0x0000000005040000-0x00000000050FB000-memory.dmp

Filesize
748KB

Download
memory/384-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/384-30-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/384-32-0x000000000C840000-0x000000000C8D8000-memory.dmp

Filesize
608KB

Download
memory/4868-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4868-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/4868-1-0x0000000001650000-0x0000000001738000-memory.dmp

Filesize
928KB

Download
memory/4868-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download