a617579a2123342e1abb144002c9a78e5550bb6700dff87f6ea998d653b2b1c0

Analysis

max time kernel
144s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47dc50b29a528265a548639b35b77f21.exe
Size

385KB
MD5

47dc50b29a528265a548639b35b77f21
SHA1

01f6a77824eca4a5490830d352e24cb1af61c80b
SHA256

a617579a2123342e1abb144002c9a78e5550bb6700dff87f6ea998d653b2b1c0
SHA512

7c941710f48d2899e8fc30578b54f7a8ba89f8d51c2cca5be3fb2540d2760767b894caaa047805ecfc70b9a815ece3794cb7613edfd33e22cd626997831b9c46
SSDEEP

6144:NPBmIXqM3kUBUAHzmbfOgH6/GatLt2W0kea+Pb60uGtfDQtt92r2l5B:NpmID3bUATmbfbH6vxqLaOF7fDQt+2TB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2276	47dc50b29a528265a548639b35b77f21.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	47dc50b29a528265a548639b35b77f21.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2912	47dc50b29a528265a548639b35b77f21.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2912	47dc50b29a528265a548639b35b77f21.exe
2276	47dc50b29a528265a548639b35b77f21.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2276	2912	47dc50b29a528265a548639b35b77f21.exe	95
PID 2912 wrote to memory of 2276	2912	47dc50b29a528265a548639b35b77f21.exe	95
PID 2912 wrote to memory of 2276	2912	47dc50b29a528265a548639b35b77f21.exe	95

C:\Users\Admin\AppData\Local\Temp\47dc50b29a528265a548639b35b77f21.exe
"C:\Users\Admin\AppData\Local\Temp\47dc50b29a528265a548639b35b77f21.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\47dc50b29a528265a548639b35b77f21.exe
  C:\Users\Admin\AppData\Local\Temp\47dc50b29a528265a548639b35b77f21.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\47dc50b29a528265a548639b35b77f21.exe

Filesize
385KB

MD5
b17016227d644ec7c3f03aad0562545d

SHA1
0eb5117fc0c38d1a184a11b58cfef61613e2f200

SHA256
985fdf44b5ac4e3b951502832f03359ac38a42a9ca93600832bdb4e3c05fa888

SHA512
57d6a5f9e247faae7b9bbbb62a695f011bdb2b8a1657252f26070f25bfaf50c5ff177aa64c5c707f4a50a941d79619bfe0643f28e4c6c211c94bc702817745c0

Download Submit
memory/2276-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2276-14-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/2276-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/2276-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2276-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2276-35-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/2276-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2912-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2912-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/2912-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2912-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download