6fbb93697f9fed8a692f78e59b3745b8b517c742a1dd6adaf935989b6a9609a0

Analysis

max time kernel
1s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52126eabe5a3576cd49943842107c5b9.exe
Size

385KB
MD5

52126eabe5a3576cd49943842107c5b9
SHA1

d8a3390bf6665c187407e6013f46c1986182b83b
SHA256

6fbb93697f9fed8a692f78e59b3745b8b517c742a1dd6adaf935989b6a9609a0
SHA512

6ea30f308ef99c6d894576eab72bb71cac255e646c16d9c8d64c86dae877855b6295e016ad6c621ab90bacf98654a8c7f09fc976b3f45ff773999d95c303f16b
SSDEEP

6144:bovaNItfbUasWmsJNjKdoOUxdS1cu3zIJTV2/0qPjO2BdqMKaZL6pB:bo3zU78jKWOaWmZ20q1fKsL6pB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2652	52126eabe5a3576cd49943842107c5b9.exe

Executes dropped EXE 1 IoCs

pid	Process
2652	52126eabe5a3576cd49943842107c5b9.exe

Loads dropped DLL 1 IoCs

pid	Process
1888	52126eabe5a3576cd49943842107c5b9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1888	52126eabe5a3576cd49943842107c5b9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1888	52126eabe5a3576cd49943842107c5b9.exe
2652	52126eabe5a3576cd49943842107c5b9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2652	1888	52126eabe5a3576cd49943842107c5b9.exe	16
PID 1888 wrote to memory of 2652	1888	52126eabe5a3576cd49943842107c5b9.exe	16
PID 1888 wrote to memory of 2652	1888	52126eabe5a3576cd49943842107c5b9.exe	16
PID 1888 wrote to memory of 2652	1888	52126eabe5a3576cd49943842107c5b9.exe	16

C:\Users\Admin\AppData\Local\Temp\52126eabe5a3576cd49943842107c5b9.exe
"C:\Users\Admin\AppData\Local\Temp\52126eabe5a3576cd49943842107c5b9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\52126eabe5a3576cd49943842107c5b9.exe
  C:\Users\Admin\AppData\Local\Temp\52126eabe5a3576cd49943842107c5b9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1888-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1888-15-0x0000000002E70000-0x0000000002ED6000-memory.dmp

Filesize
408KB

Download
memory/1888-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1888-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2652-18-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2652-20-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2652-26-0x00000000003A0000-0x00000000003FF000-memory.dmp

Filesize
380KB

Download
memory/2652-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2652-83-0x000000000EDD0000-0x000000000EE0C000-memory.dmp

Filesize
240KB

Download
memory/2652-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2652-77-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download