ea2d52e484d3503420713799027435a3707862bd6417f0a4c02d9366b7a86265

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

369c704d9dba4db51998ae9476d35457.exe
Size

771KB
MD5

369c704d9dba4db51998ae9476d35457
SHA1

66fad780c4966e0be62df9ffc63a754540818a91
SHA256

ea2d52e484d3503420713799027435a3707862bd6417f0a4c02d9366b7a86265
SHA512

9050e679e39dcd70bc7886584b5afba7f15cbcdc7c3e353e22cda21ee5c814e098cc6297e46cc21fe0c54da66eeae6bc4b5bace88ff759cb491b3920f25a3cca
SSDEEP

24576:EzA7R9LCXuxS4YEzb10hJaothZ2/T6FBBB:ECuXud/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3564	369c704d9dba4db51998ae9476d35457.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	369c704d9dba4db51998ae9476d35457.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4416	369c704d9dba4db51998ae9476d35457.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4416	369c704d9dba4db51998ae9476d35457.exe
3564	369c704d9dba4db51998ae9476d35457.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3564	4416	369c704d9dba4db51998ae9476d35457.exe	16
PID 4416 wrote to memory of 3564	4416	369c704d9dba4db51998ae9476d35457.exe	16
PID 4416 wrote to memory of 3564	4416	369c704d9dba4db51998ae9476d35457.exe	16

C:\Users\Admin\AppData\Local\Temp\369c704d9dba4db51998ae9476d35457.exe
"C:\Users\Admin\AppData\Local\Temp\369c704d9dba4db51998ae9476d35457.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\369c704d9dba4db51998ae9476d35457.exe
  C:\Users\Admin\AppData\Local\Temp\369c704d9dba4db51998ae9476d35457.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3564-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3564-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3564-20-0x00000000015E0000-0x000000000163F000-memory.dmp

Filesize
380KB

Download
memory/3564-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3564-36-0x000000000B620000-0x000000000B65C000-memory.dmp

Filesize
240KB

Download
memory/3564-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3564-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3564-37-0x000000000B620000-0x000000000B65C000-memory.dmp

Filesize
240KB

Download
memory/4416-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4416-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4416-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4416-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download