52c92c5c4d7c8403ba6e5dbc4efb1dfb41b7b47214e1c30eaea9e2c2c811670c

Analysis

max time kernel
152s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6416414c30998cbe193ea40b0e75115e.exe
Size

385KB
MD5

6416414c30998cbe193ea40b0e75115e
SHA1

581cdcec64d82f42272a30d032c6fbfde6d04b1b
SHA256

52c92c5c4d7c8403ba6e5dbc4efb1dfb41b7b47214e1c30eaea9e2c2c811670c
SHA512

82bdacafca473bc27348b321448813aa88b5dbfa11bb6ff09f4a9a25524d9cfc5c099aa03b30792affdf5a730c20f3d54dd212bf14dfdd8d282c26e6361be1db
SSDEEP

12288:XDBREd40Wth/s7QCDG7RFLq1YV/0TJZTIGB:XttiD+qTTJaGB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4216	6416414c30998cbe193ea40b0e75115e.exe

Executes dropped EXE 1 IoCs

pid	Process
4216	6416414c30998cbe193ea40b0e75115e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
488	6416414c30998cbe193ea40b0e75115e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
488	6416414c30998cbe193ea40b0e75115e.exe
4216	6416414c30998cbe193ea40b0e75115e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4216	488	6416414c30998cbe193ea40b0e75115e.exe	85
PID 488 wrote to memory of 4216	488	6416414c30998cbe193ea40b0e75115e.exe	85
PID 488 wrote to memory of 4216	488	6416414c30998cbe193ea40b0e75115e.exe	85

C:\Users\Admin\AppData\Local\Temp\6416414c30998cbe193ea40b0e75115e.exe
"C:\Users\Admin\AppData\Local\Temp\6416414c30998cbe193ea40b0e75115e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\6416414c30998cbe193ea40b0e75115e.exe
  C:\Users\Admin\AppData\Local\Temp\6416414c30998cbe193ea40b0e75115e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6416414c30998cbe193ea40b0e75115e.exe

Filesize
385KB

MD5
fc3132260661fdeeec6685e7d01a425c

SHA1
f188df2f92ba75f10f68e523d215c59d52382be9

SHA256
a99b62d78f8243311860eb8c57d0b0083aa89a4b5cf9fca0c52f9e48b0448c9f

SHA512
8baae3581d1d53afedb89ff43f333d2bac89d9e6344bd83227bfa053c9b11c9d9177359baa924d365c7e3ef0159e2457a081c6299d2bdad520592e20f3e46925

Download Submit
memory/488-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/488-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/488-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/488-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4216-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4216-15-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/4216-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4216-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

Filesize
380KB

Download
memory/4216-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4216-33-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/4216-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download