7e469479344102b86ef3add6d3ded7b2202361dc2984e05b648526099c5e609b

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d622d50f166ddd31ee458a94ebb371e.exe
Size

907KB
MD5

4d622d50f166ddd31ee458a94ebb371e
SHA1

1e7979904e0dd13b2c1c0fc3a2f080669bc67c75
SHA256

7e469479344102b86ef3add6d3ded7b2202361dc2984e05b648526099c5e609b
SHA512

246b6f338dea5e78e6b6f500d9ab4abeaa6b973eada1aed338352df9eac6f4a2ec9f5c5d8bcfbc3e8ff69a03cfb996d3d1336fa368ed74eaab1c763cb4a9bf59
SSDEEP

12288:+Ih2oe7g38zqHr4302NVhHjp7rqDRfa3rYcy4R/zVHSchmOOJA7dSjVDa/ZS1:2qHr433D9hrKRfabZ1SUh7ea/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2364	4d622d50f166ddd31ee458a94ebb371e.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	4d622d50f166ddd31ee458a94ebb371e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1840	4d622d50f166ddd31ee458a94ebb371e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1840	4d622d50f166ddd31ee458a94ebb371e.exe
2364	4d622d50f166ddd31ee458a94ebb371e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2364	1840	4d622d50f166ddd31ee458a94ebb371e.exe	93
PID 1840 wrote to memory of 2364	1840	4d622d50f166ddd31ee458a94ebb371e.exe	93
PID 1840 wrote to memory of 2364	1840	4d622d50f166ddd31ee458a94ebb371e.exe	93

C:\Users\Admin\AppData\Local\Temp\4d622d50f166ddd31ee458a94ebb371e.exe
"C:\Users\Admin\AppData\Local\Temp\4d622d50f166ddd31ee458a94ebb371e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\4d622d50f166ddd31ee458a94ebb371e.exe
  C:\Users\Admin\AppData\Local\Temp\4d622d50f166ddd31ee458a94ebb371e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4d622d50f166ddd31ee458a94ebb371e.exe

Filesize
164KB

MD5
323a71788a8162d191cdc267d8078cf9

SHA1
f1b1461214c34e289d36b6f28547c7ef3ddffba4

SHA256
90d94cdfa18e5e588789ac7e18d4ed93723ed34da5bc3311c39492dbc6539d0b

SHA512
e0d40f03281f05a0b1d46c09f81d61c6a27ba571b6f1e5d7ea690dea907235b99e74a51e9042cf652f95e2af32c5f74e02b9ffde278b35f750c86ade205faeea

Download Submit
memory/1840-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1840-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1840-1-0x0000000001750000-0x0000000001838000-memory.dmp

Filesize
928KB

Download
memory/1840-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2364-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2364-21-0x00000000051E0000-0x000000000529B000-memory.dmp

Filesize
748KB

Download
memory/2364-20-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2364-15-0x0000000001760000-0x0000000001848000-memory.dmp

Filesize
928KB

Download
memory/2364-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2364-36-0x000000000C820000-0x000000000C8B8000-memory.dmp

Filesize
608KB

Download