37f45172ad98f1d52d5cabd9312b4c735215b431fbe65e5587df9fe58ca5a298

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

771f8026e14e9bc1c299cdbfc0b2dc7e.exe
Size

771KB
MD5

771f8026e14e9bc1c299cdbfc0b2dc7e
SHA1

e57d8c79d0e35b85bcac4083c7e5ceab50dc15ff
SHA256

37f45172ad98f1d52d5cabd9312b4c735215b431fbe65e5587df9fe58ca5a298
SHA512

ff36e7322c0973d510056007daf23d73e6de907c07ad5e5dc82c4edda9686cae5b67d959b21f72a2422c7e9eb4e257ad4e77dc76a3db5f83f7ca71d630db235a
SSDEEP

24576:KfY8HvDVLHBZhf5b10hJaothZ2/T6FBBB:YPxzbRl/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4668	771f8026e14e9bc1c299cdbfc0b2dc7e.exe

Executes dropped EXE 1 IoCs

pid	Process
4668	771f8026e14e9bc1c299cdbfc0b2dc7e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4436	771f8026e14e9bc1c299cdbfc0b2dc7e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4436	771f8026e14e9bc1c299cdbfc0b2dc7e.exe
4668	771f8026e14e9bc1c299cdbfc0b2dc7e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4668	4436	771f8026e14e9bc1c299cdbfc0b2dc7e.exe	87
PID 4436 wrote to memory of 4668	4436	771f8026e14e9bc1c299cdbfc0b2dc7e.exe	87
PID 4436 wrote to memory of 4668	4436	771f8026e14e9bc1c299cdbfc0b2dc7e.exe	87

C:\Users\Admin\AppData\Local\Temp\771f8026e14e9bc1c299cdbfc0b2dc7e.exe
"C:\Users\Admin\AppData\Local\Temp\771f8026e14e9bc1c299cdbfc0b2dc7e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\771f8026e14e9bc1c299cdbfc0b2dc7e.exe
  C:\Users\Admin\AppData\Local\Temp\771f8026e14e9bc1c299cdbfc0b2dc7e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\771f8026e14e9bc1c299cdbfc0b2dc7e.exe

Filesize
771KB

MD5
a443db9e6c62112b3835ea68be484944

SHA1
6e260981b4b65b0c51a5e812fcf84a9c86d73468

SHA256
a38528526a0a5e619276214d8e8a40d3b964bbc0cdac5d90561894e08e2a3cef

SHA512
8fa3c36cc01a178faad18b9210b5eb5b8a8d60150615bdb2456f70b5d616f3f3c2b4d277c232619cbf5fa39122a5202a6a1276c6bb6f66808c7fd6e27e46b7c2

Download Submit
memory/4436-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4436-1-0x0000000001620000-0x0000000001686000-memory.dmp

Filesize
408KB

Download
memory/4436-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4436-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4668-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4668-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4668-20-0x0000000004E90000-0x0000000004EEF000-memory.dmp

Filesize
380KB

Download
memory/4668-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4668-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4668-33-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/4668-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download