c09164dd2eb417fb38dbc2f754f15385dc4191b86ac502b9f6c11a5b13b84696

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

419011f4e0e4e2eaf1351a50702e769a.exe
Size

385KB
MD5

419011f4e0e4e2eaf1351a50702e769a
SHA1

3b437cc7a394fb09d6f2463a3710045310258ba8
SHA256

c09164dd2eb417fb38dbc2f754f15385dc4191b86ac502b9f6c11a5b13b84696
SHA512

9fd39a7e91ae60d88eabfea214fedf155cfefe8b50727b0a169c42e95f26fdaae0ea1d63cd2fc1a0976c661af1ec96236d6e31a88005721c8e123ef723db19e6
SSDEEP

6144:/zhPi5C31VOKtttU31Dq145tR6RVDaL1RW1tcXrIB5CCPx624np+iftnwB:VPWC31Ptm1B96RpSRW7cXY5awimB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5076	419011f4e0e4e2eaf1351a50702e769a.exe

Executes dropped EXE 1 IoCs

pid	Process
5076	419011f4e0e4e2eaf1351a50702e769a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5056	419011f4e0e4e2eaf1351a50702e769a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5056	419011f4e0e4e2eaf1351a50702e769a.exe
5076	419011f4e0e4e2eaf1351a50702e769a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 5076	5056	419011f4e0e4e2eaf1351a50702e769a.exe	19
PID 5056 wrote to memory of 5076	5056	419011f4e0e4e2eaf1351a50702e769a.exe	19
PID 5056 wrote to memory of 5076	5056	419011f4e0e4e2eaf1351a50702e769a.exe	19

C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe
"C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe
  C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe

Filesize
126KB

MD5
eb71b4830d8e22d8999fd4f70c847a6b

SHA1
6f1caef5d54518285464bb09e8b8352733545406

SHA256
931fef963029735980aec1fe3e063bea059cbe538b247b78e114e78fefcccc98

SHA512
6bcefa9fb872e3ea23ab7a13b0694ba97e2a875ab81746e1531f68991f02b79e95e858ae3ad1508e7d4624c0caeab2d31260ed2d10a088bfb6d25984ef0e51dd

Download Submit
memory/5056-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5056-1-0x0000000001650000-0x00000000016B6000-memory.dmp

Filesize
408KB

Download
memory/5056-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/5056-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/5076-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/5076-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5076-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5076-16-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/5076-36-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/5076-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5076-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5076-37-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download