592dc515c6a2c05f87bea406117124f9217faa977bff72b88c9948404562d865

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7cf87f053b9f420480b2ea5a3ad360b0.exe
Size

771KB
MD5

7cf87f053b9f420480b2ea5a3ad360b0
SHA1

0ab2650d7fd9ad5d486d964a7721170287eaa7ce
SHA256

592dc515c6a2c05f87bea406117124f9217faa977bff72b88c9948404562d865
SHA512

056d26866182f4d3cfb07c2c7ce8988e6fd22c006445c37674d54c2cad836d242435332dae5ef8b9cc187e2a36ec0907dfbeb57c547de421379ceea0615d021e
SSDEEP

24576:MmTnwkN3AfKf4h4KZJsb10hJaothZ2/T6FBBB:MmFNwCf4h4MG/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1752	7cf87f053b9f420480b2ea5a3ad360b0.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	7cf87f053b9f420480b2ea5a3ad360b0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
220	7cf87f053b9f420480b2ea5a3ad360b0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
220	7cf87f053b9f420480b2ea5a3ad360b0.exe
1752	7cf87f053b9f420480b2ea5a3ad360b0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1752	220	7cf87f053b9f420480b2ea5a3ad360b0.exe	85
PID 220 wrote to memory of 1752	220	7cf87f053b9f420480b2ea5a3ad360b0.exe	85
PID 220 wrote to memory of 1752	220	7cf87f053b9f420480b2ea5a3ad360b0.exe	85

C:\Users\Admin\AppData\Local\Temp\7cf87f053b9f420480b2ea5a3ad360b0.exe
"C:\Users\Admin\AppData\Local\Temp\7cf87f053b9f420480b2ea5a3ad360b0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\7cf87f053b9f420480b2ea5a3ad360b0.exe
  C:\Users\Admin\AppData\Local\Temp\7cf87f053b9f420480b2ea5a3ad360b0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7cf87f053b9f420480b2ea5a3ad360b0.exe

Filesize
771KB

MD5
530d8a690f4329e0b0cfeae665a78fcb

SHA1
f2a96cf83387515bc08f49cda35327fa0dca0a88

SHA256
57b90a34368c5a8745dfab1ce828a497fca2b4b9285165183f44313871b3b09c

SHA512
58c859591d044bf9be019bbc8c6ffc72ec951700bfa83cee71577aa8c64bc141f0a63bf647f5a70e83a480779b59db3cb15e45dfdd72ca7c1c682f48fec9dc84

Download Submit
memory/220-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/220-1-0x0000000000140000-0x00000000001A6000-memory.dmp

Filesize
408KB

Download
memory/220-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/220-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1752-15-0x0000000001620000-0x0000000001686000-memory.dmp

Filesize
408KB

Download
memory/1752-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1752-20-0x0000000004F20000-0x0000000004F7F000-memory.dmp

Filesize
380KB

Download
memory/1752-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1752-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1752-32-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/1752-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download