31211fc6d68fbc2b13fca93bc961d9305f3a63fb520e45b6e8824b516f4f4be4

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4aebceb6a012a650d0df5f6d57743074.exe
Size

385KB
MD5

4aebceb6a012a650d0df5f6d57743074
SHA1

f474410dc3ddd263eb2f9b4a9b2fee14d8baab7b
SHA256

31211fc6d68fbc2b13fca93bc961d9305f3a63fb520e45b6e8824b516f4f4be4
SHA512

de1590abd7bd1cd425cbee7c9f047097dbd920b73ffca7169c5043b0c58099d13ad2b4d51cd1be4b803e4ea51d060a91530ee888bf6c69fec6620927c6dd288f
SSDEEP

12288:dnua7gB8iu/SJyHjs38kblvJm28fO+ZKyB:dnua7H/SJygLblvo2SO+ZKyB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3936	4aebceb6a012a650d0df5f6d57743074.exe

Executes dropped EXE 1 IoCs

pid	Process
3936	4aebceb6a012a650d0df5f6d57743074.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3356	4aebceb6a012a650d0df5f6d57743074.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3356	4aebceb6a012a650d0df5f6d57743074.exe
3936	4aebceb6a012a650d0df5f6d57743074.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3936	3356	4aebceb6a012a650d0df5f6d57743074.exe	88
PID 3356 wrote to memory of 3936	3356	4aebceb6a012a650d0df5f6d57743074.exe	88
PID 3356 wrote to memory of 3936	3356	4aebceb6a012a650d0df5f6d57743074.exe	88

C:\Users\Admin\AppData\Local\Temp\4aebceb6a012a650d0df5f6d57743074.exe
"C:\Users\Admin\AppData\Local\Temp\4aebceb6a012a650d0df5f6d57743074.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\4aebceb6a012a650d0df5f6d57743074.exe
  C:\Users\Admin\AppData\Local\Temp\4aebceb6a012a650d0df5f6d57743074.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4aebceb6a012a650d0df5f6d57743074.exe

Filesize
138KB

MD5
bdf2ed0b499e90aaa09cade2f7696785

SHA1
f9a4a076b5d59dbc83153c2c7cd1c65abec0424a

SHA256
d195101d4743f9f51863a4aa40ed9f6ec0371b146f32afa8b038d88cfe2b3fe9

SHA512
d6016b3bb67dc6a577971ebfa5cb8cdf2fe1b3a3a9b226baa3c5d2b579b36b0b2f839eeb2dc3a3959d9816765edd018806b5d9f5bffd784ecbef799512393c87

Download Submit
memory/3356-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3356-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3356-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3356-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3936-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3936-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3936-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3936-20-0x00000000015F0000-0x000000000164F000-memory.dmp

Filesize
380KB

Download
memory/3936-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3936-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3936-36-0x000000000D660000-0x000000000D69C000-memory.dmp

Filesize
240KB

Download