20b4cb5651e55daf56bc4e4a529fbb7e68783ca3221589e10d20c3ac2050da48

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

667635562c8f41687b12b34430a9d10d.exe
Size

771KB
MD5

667635562c8f41687b12b34430a9d10d
SHA1

c42cfe4458b4b4a28a114b1fb3f6869bf7ba4330
SHA256

20b4cb5651e55daf56bc4e4a529fbb7e68783ca3221589e10d20c3ac2050da48
SHA512

31143d1034ac4e2a80b6a33022c27132557df7b934a3a5671d6dcbadce454c42b9d00e1bbb7552e1e6d3bda2eb4408bddcdc9339444ebccdb044cd1cc7874859
SSDEEP

12288:YuS3800PxIrZxsT2tejsCbomm+zSe+msb10VHmDXTuFaa2AtyGTKOF25ZoJJyhRY:LJII6tejsCH2b10hJaothZ2/T6FBBB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4828	667635562c8f41687b12b34430a9d10d.exe

Executes dropped EXE 1 IoCs

pid	Process
4828	667635562c8f41687b12b34430a9d10d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1000	667635562c8f41687b12b34430a9d10d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1000	667635562c8f41687b12b34430a9d10d.exe
4828	667635562c8f41687b12b34430a9d10d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4828	1000	667635562c8f41687b12b34430a9d10d.exe	87
PID 1000 wrote to memory of 4828	1000	667635562c8f41687b12b34430a9d10d.exe	87
PID 1000 wrote to memory of 4828	1000	667635562c8f41687b12b34430a9d10d.exe	87

C:\Users\Admin\AppData\Local\Temp\667635562c8f41687b12b34430a9d10d.exe
"C:\Users\Admin\AppData\Local\Temp\667635562c8f41687b12b34430a9d10d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\667635562c8f41687b12b34430a9d10d.exe
  C:\Users\Admin\AppData\Local\Temp\667635562c8f41687b12b34430a9d10d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\667635562c8f41687b12b34430a9d10d.exe

Filesize
771KB

MD5
ef0d53f5d870e6aa8315a03d427fdb86

SHA1
2a6fefa03148c6d1d5d40edfa3bd06157e615a81

SHA256
dcffc136d36ed689049594efe26b40def2ae392677603c9f4830b4f6686f97fd

SHA512
d175bd87a0ac881a29ee8f905de57aea25f54fcd55ab74229de1e7868862161c1bed3d8b33eba7b613b214b066c4a3c4456b49458be79752c7c6055045a6554d

Download Submit
memory/1000-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1000-1-0x0000000000160000-0x00000000001C6000-memory.dmp

Filesize
408KB

Download
memory/1000-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1000-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4828-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4828-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4828-20-0x0000000001620000-0x000000000167F000-memory.dmp

Filesize
380KB

Download
memory/4828-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4828-32-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/4828-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4828-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download