4e18bb40ba2300b341ff6ebe5737c21786c1d36652d17dc4cf01eec3ce3cb10a

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7be07f4401c13ee605a127ba05668256.exe
Size

385KB
MD5

7be07f4401c13ee605a127ba05668256
SHA1

ac5d970a2e3df5e52e5941ebc02302bec55ba563
SHA256

4e18bb40ba2300b341ff6ebe5737c21786c1d36652d17dc4cf01eec3ce3cb10a
SHA512

07cdeb35565ae5c5430fb1ff36d50df0c65d87803359f5896fd2010d5129374f2daf21e521a88507f09c05943e0dcaf009a12669eb7d8a0aa1e5e501735a4d8f
SSDEEP

12288:rBHc4c+fT5Rd4K/y3O5+PjVx5FgeniIjqZ0HrB:rBHc4c+r5P1K3O5+PxTFgendjqiHrB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2916	7be07f4401c13ee605a127ba05668256.exe

Executes dropped EXE 1 IoCs

pid	Process
2916	7be07f4401c13ee605a127ba05668256.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1160	7be07f4401c13ee605a127ba05668256.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1160	7be07f4401c13ee605a127ba05668256.exe
2916	7be07f4401c13ee605a127ba05668256.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2916	1160	7be07f4401c13ee605a127ba05668256.exe	87
PID 1160 wrote to memory of 2916	1160	7be07f4401c13ee605a127ba05668256.exe	87
PID 1160 wrote to memory of 2916	1160	7be07f4401c13ee605a127ba05668256.exe	87

C:\Users\Admin\AppData\Local\Temp\7be07f4401c13ee605a127ba05668256.exe
"C:\Users\Admin\AppData\Local\Temp\7be07f4401c13ee605a127ba05668256.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\7be07f4401c13ee605a127ba05668256.exe
  C:\Users\Admin\AppData\Local\Temp\7be07f4401c13ee605a127ba05668256.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7be07f4401c13ee605a127ba05668256.exe

Filesize
385KB

MD5
a4a0cb26f8c87402b4a103de46ab354d

SHA1
3947a14356753bf4ee5c0da3d3a8df1aa5f8dfdc

SHA256
ee209173b66c2b7fa4791c19c1cb0925f10db6e5cfb8030726f8e4592246bbda

SHA512
182f17d96ea860b21833fb80328771ad15925b0aa9ded673eb965a4d9234c5a0ed63f7e99e5b525e5c199552665a233823a89c2554d55ec2fb9fd9fb7a04d674

Download Submit
memory/1160-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1160-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/1160-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1160-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2916-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2916-16-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/2916-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/2916-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2916-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2916-37-0x000000000C620000-0x000000000C65C000-memory.dmp

Filesize
240KB

Download
memory/2916-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download