6affba56941cee60db4d5dd07f4b73beaa7ece75312a69c7a5b9a11f12678ff4

Analysis

max time kernel
88s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7af96ac1a116bcdf139fb87cff1cec49.exe
Size

385KB
MD5

7af96ac1a116bcdf139fb87cff1cec49
SHA1

be01ef308356b3aa0dd4a01de3cf17698b68dd85
SHA256

6affba56941cee60db4d5dd07f4b73beaa7ece75312a69c7a5b9a11f12678ff4
SHA512

77fd47cd8ee58c2a3f8e1bec53c42a515b7a19a62659eb96e76bd909c32e8cc6addf889fa26c1a53a5a61433821d363be33e5d93d3061e3dfeabe987a5a7c518
SSDEEP

6144:4TONjMnXGFUIlLz1gw5Y1ngQeO1w3yFdk3tllnIoxc3EIbQZYhB:4TtYtz195YF3pwiF+3ZnIoxcU7EB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4984	7af96ac1a116bcdf139fb87cff1cec49.exe

Executes dropped EXE 1 IoCs

pid	Process
4984	7af96ac1a116bcdf139fb87cff1cec49.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3080	7af96ac1a116bcdf139fb87cff1cec49.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3080	7af96ac1a116bcdf139fb87cff1cec49.exe
4984	7af96ac1a116bcdf139fb87cff1cec49.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4984	3080	7af96ac1a116bcdf139fb87cff1cec49.exe	86
PID 3080 wrote to memory of 4984	3080	7af96ac1a116bcdf139fb87cff1cec49.exe	86
PID 3080 wrote to memory of 4984	3080	7af96ac1a116bcdf139fb87cff1cec49.exe	86

C:\Users\Admin\AppData\Local\Temp\7af96ac1a116bcdf139fb87cff1cec49.exe
"C:\Users\Admin\AppData\Local\Temp\7af96ac1a116bcdf139fb87cff1cec49.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\7af96ac1a116bcdf139fb87cff1cec49.exe
  C:\Users\Admin\AppData\Local\Temp\7af96ac1a116bcdf139fb87cff1cec49.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7af96ac1a116bcdf139fb87cff1cec49.exe

Filesize
385KB

MD5
1972eccc0e81538bf0a2656e5db31f74

SHA1
b224655bf5d43f404dec5730ca4cb01cf16d386a

SHA256
10610ad63e115e9cb8ffb2253829d939a07267184be8df44f444311cf09e1900

SHA512
028080be86329338a999a45d5d8498db12bd2cd1a67e6b6cdbefcecbf69b05fbec1f86cf8ad311c568c18827f5567f49e9f25b161145fdc1a5deed3372789b45

Download Submit
memory/3080-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3080-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3080-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3080-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4984-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4984-15-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4984-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/4984-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4984-31-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/4984-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4984-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download