ac618e1db2489ae9d4c04d4fc59ce5b4983a0a722f4a4bb1e96b622366c7d41b

Analysis

max time kernel
1s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

450bbf7395a5b67abfaa179cdcd1bd23.exe
Size

907KB
MD5

450bbf7395a5b67abfaa179cdcd1bd23
SHA1

4c35cb7ea0c4b6963184a78f43e2a4243afb7b0a
SHA256

ac618e1db2489ae9d4c04d4fc59ce5b4983a0a722f4a4bb1e96b622366c7d41b
SHA512

ca74209f63e20e7af06affe082eae177962f4039bd3834d26448a045b01dd31434fd93558b70643d9ba449caa5d080728b1f5201e9d0793fa46420d22d089334
SSDEEP

24576:Ug9/T/ipcBZAD8JGNkHHpDjhjzbEfZZHqra/ZS1:UOTGcaWXHphC0gS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2648	450bbf7395a5b67abfaa179cdcd1bd23.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	450bbf7395a5b67abfaa179cdcd1bd23.exe

Loads dropped DLL 1 IoCs

pid	Process
2480	450bbf7395a5b67abfaa179cdcd1bd23.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2480	450bbf7395a5b67abfaa179cdcd1bd23.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2480	450bbf7395a5b67abfaa179cdcd1bd23.exe
2648	450bbf7395a5b67abfaa179cdcd1bd23.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2648	2480	450bbf7395a5b67abfaa179cdcd1bd23.exe	15
PID 2480 wrote to memory of 2648	2480	450bbf7395a5b67abfaa179cdcd1bd23.exe	15
PID 2480 wrote to memory of 2648	2480	450bbf7395a5b67abfaa179cdcd1bd23.exe	15
PID 2480 wrote to memory of 2648	2480	450bbf7395a5b67abfaa179cdcd1bd23.exe	15

C:\Users\Admin\AppData\Local\Temp\450bbf7395a5b67abfaa179cdcd1bd23.exe
C:\Users\Admin\AppData\Local\Temp\450bbf7395a5b67abfaa179cdcd1bd23.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2648

C:\Users\Admin\AppData\Local\Temp\450bbf7395a5b67abfaa179cdcd1bd23.exe
"C:\Users\Admin\AppData\Local\Temp\450bbf7395a5b67abfaa179cdcd1bd23.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-3-0x00000000014F0000-0x00000000015D8000-memory.dmp

Filesize
928KB

Download
memory/2480-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2480-14-0x0000000003200000-0x00000000032E8000-memory.dmp

Filesize
928KB

Download
memory/2480-13-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2480-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2648-16-0x00000000002D0000-0x00000000003B8000-memory.dmp

Filesize
928KB

Download
memory/2648-29-0x0000000002F40000-0x0000000002FFB000-memory.dmp

Filesize
748KB

Download
memory/2648-23-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2648-18-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2648-83-0x0000000007810000-0x00000000078A8000-memory.dmp

Filesize
608KB

Download
memory/2648-77-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download