17697422faa8ceb2b14f0439a82480f5b33bd28651040d1a70017dbbc7845339

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3faae1a35e56848955a1a75c5ee5133f.exe
Size

907KB
MD5

3faae1a35e56848955a1a75c5ee5133f
SHA1

9998c942fbedaecd027d910a4ca2b634c9b714fa
SHA256

17697422faa8ceb2b14f0439a82480f5b33bd28651040d1a70017dbbc7845339
SHA512

084bc0909cbdacf25d04e4fc1a6537680d7906544116851cab674a1bebc208c5fcd2e84f515845c85db5ff245b9ff5e092f729187e51e7370121c77dd1542833
SSDEEP

24576:r9gX5KgTBfs0A+3xnBjV4+jomN4Ta/ZS1:rhCRsqxnI+s+4TgS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2920	3faae1a35e56848955a1a75c5ee5133f.exe

Executes dropped EXE 1 IoCs

pid	Process
2920	3faae1a35e56848955a1a75c5ee5133f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1984	3faae1a35e56848955a1a75c5ee5133f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1984	3faae1a35e56848955a1a75c5ee5133f.exe
2920	3faae1a35e56848955a1a75c5ee5133f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2920	1984	3faae1a35e56848955a1a75c5ee5133f.exe	22
PID 1984 wrote to memory of 2920	1984	3faae1a35e56848955a1a75c5ee5133f.exe	22
PID 1984 wrote to memory of 2920	1984	3faae1a35e56848955a1a75c5ee5133f.exe	22

C:\Users\Admin\AppData\Local\Temp\3faae1a35e56848955a1a75c5ee5133f.exe
"C:\Users\Admin\AppData\Local\Temp\3faae1a35e56848955a1a75c5ee5133f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\3faae1a35e56848955a1a75c5ee5133f.exe
  C:\Users\Admin\AppData\Local\Temp\3faae1a35e56848955a1a75c5ee5133f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3faae1a35e56848955a1a75c5ee5133f.exe

Filesize
50KB

MD5
bb2302b27beb08fca137e294487b0f84

SHA1
a338426c733dab4d4d4a24a0342416a903934121

SHA256
3c567b19d34469ab5c45d847d517a822d617ca4eb561ab7215864dacb046b781

SHA512
212fcc76b885493eea049bd008257d4ff1bba623e2202addb46c4cb1a826798e4a84168a225feae09a28986afdac93d8bf3794ffb4866d1ff5d221bc5b953204

Download Submit
memory/1984-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1984-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1984-1-0x0000000001680000-0x0000000001768000-memory.dmp

Filesize
928KB

Download
memory/1984-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2920-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2920-16-0x0000000001690000-0x0000000001778000-memory.dmp

Filesize
928KB

Download
memory/2920-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2920-20-0x0000000005060000-0x000000000511B000-memory.dmp

Filesize
748KB

Download
memory/2920-30-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2920-33-0x000000000B800000-0x000000000B898000-memory.dmp

Filesize
608KB

Download