39c6cefffa65c0aa908a00d91790e20cfaf3ca6a12ca603cc343db98d4c4a723

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a1d4dc4a2758ac16903d16c8bafa39d.exe
Size

771KB
MD5

4a1d4dc4a2758ac16903d16c8bafa39d
SHA1

a1649e133246ae793c252f89d378ca86014f918e
SHA256

39c6cefffa65c0aa908a00d91790e20cfaf3ca6a12ca603cc343db98d4c4a723
SHA512

5ed3676a574aabc55f71f8dbe0eb7601ce85cca1a5b9e9b1039d9b63f40d58838f22b99801899dd38c8783ac7aaa6472403d88fe6b4b8d6969d655583db40762
SSDEEP

24576:bJddESnfcz8v5dXzxCLrAIWe2xDigUIHQoiy9TGiEdDdbfFuJ36NoO3bM2d5CeI+:bJddESnfcz8v5dXzxCLrAIWe2xNUIHQ5

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3520	4a1d4dc4a2758ac16903d16c8bafa39d.exe

Executes dropped EXE 1 IoCs

pid	Process
3520	4a1d4dc4a2758ac16903d16c8bafa39d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2116	4a1d4dc4a2758ac16903d16c8bafa39d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2116	4a1d4dc4a2758ac16903d16c8bafa39d.exe
3520	4a1d4dc4a2758ac16903d16c8bafa39d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3520	2116	4a1d4dc4a2758ac16903d16c8bafa39d.exe	89
PID 2116 wrote to memory of 3520	2116	4a1d4dc4a2758ac16903d16c8bafa39d.exe	89
PID 2116 wrote to memory of 3520	2116	4a1d4dc4a2758ac16903d16c8bafa39d.exe	89

C:\Users\Admin\AppData\Local\Temp\4a1d4dc4a2758ac16903d16c8bafa39d.exe
"C:\Users\Admin\AppData\Local\Temp\4a1d4dc4a2758ac16903d16c8bafa39d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\4a1d4dc4a2758ac16903d16c8bafa39d.exe
  C:\Users\Admin\AppData\Local\Temp\4a1d4dc4a2758ac16903d16c8bafa39d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4a1d4dc4a2758ac16903d16c8bafa39d.exe

Filesize
771KB

MD5
03520d1fa27216ffe161b2d62e102120

SHA1
e0559150b44333b779b3e731d0820e28a10be0ff

SHA256
5f020217e5fb37a0c572fc9389b7b7a78e126c3df091b6def76b7de2277e9ba2

SHA512
c09953d591a00f7e787ecad7bff465b34f3d033a3428eb163e030014ece60a86a10ea67c465b43d16721aa9a24f3d2d7bc4b6a786028347248e65fb08f1a228c

Download Submit
memory/2116-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2116-1-0x0000000000160000-0x00000000001C6000-memory.dmp

Filesize
408KB

Download
memory/2116-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2116-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3520-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3520-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3520-24-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

Filesize
380KB

Download
memory/3520-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3520-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3520-37-0x000000000D660000-0x000000000D69C000-memory.dmp

Filesize
240KB

Download
memory/3520-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download