Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 20:00

General

  • Target

    3ef1f5a985a26a50781d07c540ca18e2.exe

  • Size

    385KB

  • MD5

    3ef1f5a985a26a50781d07c540ca18e2

  • SHA1

    c78fd117e3e290b912f81ce4432ccbb8b239cfb4

  • SHA256

    f74e6c6e6d19a64254d74e98901144486d2e359fab4e21f818c7d4c72b7928db

  • SHA512

    ad249534766feac1dc6dd1dd1668817517079966469391101624b847d0e99d6ea66257819f6377bf9364f65e7471222a03f58a4aa82ae23913b5c69093f71d8b

  • SSDEEP

    6144:I4TRbGJpsJwue/Zfn3gtrqJcIKyrROQpo+E5KFT69Qv6l2OLwPDLTuPpPi8xysLB:9Rbmd3F9JhZFTSQv0fLaDXuPpryAB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ef1f5a985a26a50781d07c540ca18e2.exe
    "C:\Users\Admin\AppData\Local\Temp\3ef1f5a985a26a50781d07c540ca18e2.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\3ef1f5a985a26a50781d07c540ca18e2.exe
      C:\Users\Admin\AppData\Local\Temp\3ef1f5a985a26a50781d07c540ca18e2.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2056

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3ef1f5a985a26a50781d07c540ca18e2.exe

          Filesize

          385KB

          MD5

          fc16c2ba7ff0181c0fcd509c99608079

          SHA1

          7872de4780ea2f20caf360691ab3f28cb59c8b74

          SHA256

          7953bcf1be12f71b81879f5ec132c8f0c1b82124e2834fcc7b62cb25933b076f

          SHA512

          2153fcb7f3f3659b04bf92796eac653e852b65eb4c21051ac91289e959b25db24fecea67892def3c9f9afd326259007df044cf5381a24ff335da6405e3de74cc

        • memory/2056-13-0x0000000000400000-0x0000000000466000-memory.dmp

          Filesize

          408KB

        • memory/2056-14-0x0000000001630000-0x0000000001696000-memory.dmp

          Filesize

          408KB

        • memory/2056-21-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2056-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

          Filesize

          380KB

        • memory/2056-32-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/2056-36-0x000000000E6A0000-0x000000000E6DC000-memory.dmp

          Filesize

          240KB

        • memory/2056-38-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/4896-0-0x0000000000400000-0x0000000000466000-memory.dmp

          Filesize

          408KB

        • memory/4896-1-0x0000000001470000-0x00000000014D6000-memory.dmp

          Filesize

          408KB

        • memory/4896-2-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/4896-11-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB