253b3fb2638efdeba225da27bf070e3b7fe4f07abd28d279f6b840ef142f6974

Analysis

max time kernel
36s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4be1720a936a965ff2844e537fe86111.exe
Size

385KB
MD5

4be1720a936a965ff2844e537fe86111
SHA1

059779ac235ab816a5bff980a01b372bf9864c35
SHA256

253b3fb2638efdeba225da27bf070e3b7fe4f07abd28d279f6b840ef142f6974
SHA512

93f17629be0ee45ffad3d67a17038a2b33e336e1b20c0eda0de1c629e4e009dfec5d1b1fe063086d9b3f987c9be08679a53cf24d605f29b892939698ad5a6431
SSDEEP

6144:5mmbdIwLHHEaQIV99gxmwHdckW+BXV/AcJMlQEJctjbzHozcr5OMceZ7B:5nRHhQWXgxmgck3BBMEfZYK7B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4836	4be1720a936a965ff2844e537fe86111.exe

Executes dropped EXE 1 IoCs

pid	Process
4836	4be1720a936a965ff2844e537fe86111.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2612	4be1720a936a965ff2844e537fe86111.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2612	4be1720a936a965ff2844e537fe86111.exe
4836	4be1720a936a965ff2844e537fe86111.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4836	2612	4be1720a936a965ff2844e537fe86111.exe	27
PID 2612 wrote to memory of 4836	2612	4be1720a936a965ff2844e537fe86111.exe	27
PID 2612 wrote to memory of 4836	2612	4be1720a936a965ff2844e537fe86111.exe	27

C:\Users\Admin\AppData\Local\Temp\4be1720a936a965ff2844e537fe86111.exe
"C:\Users\Admin\AppData\Local\Temp\4be1720a936a965ff2844e537fe86111.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\4be1720a936a965ff2844e537fe86111.exe
  C:\Users\Admin\AppData\Local\Temp\4be1720a936a965ff2844e537fe86111.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2612-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2612-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2612-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4836-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4836-15-0x0000000001540000-0x00000000015A6000-memory.dmp

Filesize
408KB

Download
memory/4836-20-0x00000000015F0000-0x000000000164F000-memory.dmp

Filesize
380KB

Download
memory/4836-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4836-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4836-37-0x000000000C620000-0x000000000C65C000-memory.dmp

Filesize
240KB

Download
memory/4836-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download