7bf888baeda0aee2fef18710cb42bacd7a9d9108c7aeb8cb90d1c9bb4884dbf2

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66229822c751683645b7ecc5cd284f6a.exe
Size

385KB
MD5

66229822c751683645b7ecc5cd284f6a
SHA1

863137ebdc5e25b715cd189ec22cd2a22c4376c0
SHA256

7bf888baeda0aee2fef18710cb42bacd7a9d9108c7aeb8cb90d1c9bb4884dbf2
SHA512

bd4af44fcedf9007faec4ec463160829a09f09f3209fc30acd59c8f5f7fee6087cdbd1d64ccdb872f4fcad04535ab2b651aa710b2e27ff54fa9bddf346ccb409
SSDEEP

6144:7C448c6W1+A0L4C3U6S8Y5C6Evz9KR9Q48azBdaxkrt7u1xcJ8TUU2+B:E8c6LAEZvYhEC8QB0artKf+84l+B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4116	66229822c751683645b7ecc5cd284f6a.exe

Executes dropped EXE 1 IoCs

pid	Process
4116	66229822c751683645b7ecc5cd284f6a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4812	66229822c751683645b7ecc5cd284f6a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4812	66229822c751683645b7ecc5cd284f6a.exe
4116	66229822c751683645b7ecc5cd284f6a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4116	4812	66229822c751683645b7ecc5cd284f6a.exe	88
PID 4812 wrote to memory of 4116	4812	66229822c751683645b7ecc5cd284f6a.exe	88
PID 4812 wrote to memory of 4116	4812	66229822c751683645b7ecc5cd284f6a.exe	88

C:\Users\Admin\AppData\Local\Temp\66229822c751683645b7ecc5cd284f6a.exe
"C:\Users\Admin\AppData\Local\Temp\66229822c751683645b7ecc5cd284f6a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\66229822c751683645b7ecc5cd284f6a.exe
  C:\Users\Admin\AppData\Local\Temp\66229822c751683645b7ecc5cd284f6a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\66229822c751683645b7ecc5cd284f6a.exe

Filesize
385KB

MD5
b9cb9f465f6e64f962f59efb47344165

SHA1
36ece3c69ca6c513b7073757eef02bb0e0c67565

SHA256
dc712c16eb103cdc38eecaad3161e3fb90d4e69477605b49cabbfee97b8c9320

SHA512
2382232efbd420c3c0bc1605d8bbc5aea8d8715adc41a2ca7ccbb42a2841848c137589cec3f382fd8611a2d5c4d4630edf4ca85297d922ca897b584cd15f0261

Download Submit
memory/4116-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4116-16-0x0000000001600000-0x0000000001666000-memory.dmp

Filesize
408KB

Download
memory/4116-20-0x0000000004F60000-0x0000000004FBF000-memory.dmp

Filesize
380KB

Download
memory/4116-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4116-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4116-35-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/4116-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4812-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4812-1-0x0000000001620000-0x0000000001686000-memory.dmp

Filesize
408KB

Download
memory/4812-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4812-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download