6ceb2e87af00951a55a4e6b07e7974ae52d20c08891144d1a8461f35ef4f497c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e425ea6ef3a473c682d2e76889092ff.exe
Size

385KB
MD5

4e425ea6ef3a473c682d2e76889092ff
SHA1

0b4dbf65cb23fefc37bbaf4fd260ae780f5aeaf9
SHA256

6ceb2e87af00951a55a4e6b07e7974ae52d20c08891144d1a8461f35ef4f497c
SHA512

fca1ab35946e2d5f37b9781e4666cde98eb790551f7c8e75daca2e1f30b8acbf25ef5db915822b374574c947dd4e0864ecbe35e9004055c4d618253317b3ff76
SSDEEP

12288:yEybioVQ/PB6px/qD5fvCQpAhgg/4xSmL6B:y/FVIB6px//6g/6SmL6B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3092	4e425ea6ef3a473c682d2e76889092ff.exe

Executes dropped EXE 1 IoCs

pid	Process
3092	4e425ea6ef3a473c682d2e76889092ff.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3432	4e425ea6ef3a473c682d2e76889092ff.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3432	4e425ea6ef3a473c682d2e76889092ff.exe
3092	4e425ea6ef3a473c682d2e76889092ff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3092	3432	4e425ea6ef3a473c682d2e76889092ff.exe	92
PID 3432 wrote to memory of 3092	3432	4e425ea6ef3a473c682d2e76889092ff.exe	92
PID 3432 wrote to memory of 3092	3432	4e425ea6ef3a473c682d2e76889092ff.exe	92

C:\Users\Admin\AppData\Local\Temp\4e425ea6ef3a473c682d2e76889092ff.exe
"C:\Users\Admin\AppData\Local\Temp\4e425ea6ef3a473c682d2e76889092ff.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\4e425ea6ef3a473c682d2e76889092ff.exe
  C:\Users\Admin\AppData\Local\Temp\4e425ea6ef3a473c682d2e76889092ff.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4e425ea6ef3a473c682d2e76889092ff.exe

Filesize
385KB

MD5
841b479e3c22e8b0ddc090b09a634085

SHA1
00dbf08dacb8eb38400cdf0aa4bf2daf2bf590c0

SHA256
699683ab0f14343d4fb12665b023d171b6f56e4a5e9e5d747c4d53c0e296b68e

SHA512
353827ef19e4aba7d215ab88954f6c34fdee538d2efa8a0e4e89900a1cbd1f7a3a49be2026e4b5b97a59aa038a9884ab33e4cb335c5a712e4da2366d1239eecb

Download Submit
memory/3092-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3092-15-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3092-20-0x0000000004E90000-0x0000000004EEF000-memory.dmp

Filesize
380KB

Download
memory/3092-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3092-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3092-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3092-36-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/3432-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3432-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3432-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3432-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download