37859f1f7b8acf64f12f0ee2a5ceb69d0bc6b2e23fe2cba5c9cac2c663aff5dd

Analysis

max time kernel
72s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

432dba439b9744bedff3038e1a310452.exe
Size

385KB
MD5

432dba439b9744bedff3038e1a310452
SHA1

aac1c697fd5907e1d7fea27843bcc60cd5180830
SHA256

37859f1f7b8acf64f12f0ee2a5ceb69d0bc6b2e23fe2cba5c9cac2c663aff5dd
SHA512

e8acb86cbc6f61f4618327f6ebfce605e6d9a981230fb537465afbc2518ffeb58fc165f7fdf58b6393d5d6a12c0c6a23cdbd8504242b30d8b303bdf47286e4b5
SSDEEP

6144:9ejt+K5R2c+stSfAFCxUMfRf4T0Bs9a6OeW+r2h3HWT+dB:Q72etSyWDRf4T0MO+r2h32T+dB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4280	432dba439b9744bedff3038e1a310452.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	432dba439b9744bedff3038e1a310452.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1900	432dba439b9744bedff3038e1a310452.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1900	432dba439b9744bedff3038e1a310452.exe
4280	432dba439b9744bedff3038e1a310452.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4280	1900	432dba439b9744bedff3038e1a310452.exe	20
PID 1900 wrote to memory of 4280	1900	432dba439b9744bedff3038e1a310452.exe	20
PID 1900 wrote to memory of 4280	1900	432dba439b9744bedff3038e1a310452.exe	20

C:\Users\Admin\AppData\Local\Temp\432dba439b9744bedff3038e1a310452.exe
"C:\Users\Admin\AppData\Local\Temp\432dba439b9744bedff3038e1a310452.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\432dba439b9744bedff3038e1a310452.exe
  C:\Users\Admin\AppData\Local\Temp\432dba439b9744bedff3038e1a310452.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1900-1-0x00000000015A0000-0x0000000001606000-memory.dmp

Filesize
408KB

Download
memory/1900-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1900-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4280-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4280-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4280-20-0x0000000004EF0000-0x0000000004F4F000-memory.dmp

Filesize
380KB

Download
memory/4280-16-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4280-38-0x000000000C620000-0x000000000C65C000-memory.dmp

Filesize
240KB

Download
memory/4280-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4280-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download