da0a359988e5968fb5026e4f8c8bd07072a161dafe21bc650a07604bf5b5f1f2

Analysis

max time kernel
2s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45b33b0740788dc3c218c1127b97b77f.exe
Size

385KB
MD5

45b33b0740788dc3c218c1127b97b77f
SHA1

fcd05797328b09a4a0687231360db787c87e492b
SHA256

da0a359988e5968fb5026e4f8c8bd07072a161dafe21bc650a07604bf5b5f1f2
SHA512

d3df91a18c0c5a5c9424f068fe8c30be6ef94ae76ff42800936bb088ed7fe2cbdb315f7b1a2ebd8b151851249aefcf8ea6bca577a667aebea4d97f8ad71fbe0a
SSDEEP

6144:P1sc9BSQS5ObA+cPFC2uBnpxWtCvX6r1T7wwAB+hLzqNPDw/VoiiHRoUx7vutB:P1sc9IjPPF5Iua6rRFPhADZlx7v8B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3052	45b33b0740788dc3c218c1127b97b77f.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	45b33b0740788dc3c218c1127b97b77f.exe

Loads dropped DLL 1 IoCs

pid	Process
2092	45b33b0740788dc3c218c1127b97b77f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2092	45b33b0740788dc3c218c1127b97b77f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2092	45b33b0740788dc3c218c1127b97b77f.exe
3052	45b33b0740788dc3c218c1127b97b77f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3052	2092	45b33b0740788dc3c218c1127b97b77f.exe	14
PID 2092 wrote to memory of 3052	2092	45b33b0740788dc3c218c1127b97b77f.exe	14
PID 2092 wrote to memory of 3052	2092	45b33b0740788dc3c218c1127b97b77f.exe	14
PID 2092 wrote to memory of 3052	2092	45b33b0740788dc3c218c1127b97b77f.exe	14

C:\Users\Admin\AppData\Local\Temp\45b33b0740788dc3c218c1127b97b77f.exe
C:\Users\Admin\AppData\Local\Temp\45b33b0740788dc3c218c1127b97b77f.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3052

C:\Users\Admin\AppData\Local\Temp\45b33b0740788dc3c218c1127b97b77f.exe
"C:\Users\Admin\AppData\Local\Temp\45b33b0740788dc3c218c1127b97b77f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\45b33b0740788dc3c218c1127b97b77f.exe

Filesize
92KB

MD5
e3635ab4fb118adf242c8c2ae3e62da3

SHA1
6a5cbe6d58ecdf29cb0ce9720e3651047d5041b1

SHA256
85abb6f4b0b142170cc2d26e18506b7f8e6afe43fdf4fc4b7b9aa38db56a1b19

SHA512
e9a657cfae922e33d0a67a7c04c82938e38bd015b2aed7985f7922fa19fdb5cc1a1e3b30f07acb154fdc01667fa973e89492c4167eef0c1114ab410caf252dd2

Download Submit
memory/2092-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2092-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2092-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2092-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2092-2-0x0000000000370000-0x00000000003D6000-memory.dmp

Filesize
408KB

Download
memory/3052-19-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3052-21-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/3052-29-0x00000000002E0000-0x000000000033F000-memory.dmp

Filesize
380KB

Download
memory/3052-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3052-88-0x000000000DD40000-0x000000000DD7C000-memory.dmp

Filesize
240KB

Download
memory/3052-87-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3052-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download