Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-02-2024 08:11
General
-
Target
8660280e62243208195310b81329dc66.exe
-
Size
385KB
-
MD5
8660280e62243208195310b81329dc66
-
SHA1
608e95ec71a230d886ad96afaa557cb980f6dbaf
-
SHA256
7e4da520a3db5c10cb4f835488f9585c25a42872b6f4422a8711939f6eff63a4
-
SHA512
0619b0814dc09d4d35f81073f04affcfa012fcbc3e18925f1da8f9b97a6746a3be36dd7b6462396f62ad50cf712b622071daa77bb080a45a09d9d5197feac278
-
SSDEEP
6144:JuNJQJ0QYK+ymcrBGKs8SWdw6DlUQ4Mmaq5wzjRGQwEqHxP0Ntt8CsktlkFQokjB:qoFuFODlUQxmajzlGQw790Nj7VKFeB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8660280e62243208195310b81329dc66.exe"C:\Users\Admin\AppData\Local\Temp\8660280e62243208195310b81329dc66.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8660280e62243208195310b81329dc66.exeC:\Users\Admin\AppData\Local\Temp\8660280e62243208195310b81329dc66.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5931d4755bc0f0e7f26cc8ed3b5eef8f6
SHA1f280a774f21d7b5293ee7c602c6678cd0b740818
SHA25615044ad81dcaa4bed0838a507dc549d91851286fffb3f8cf1a3f40bcb1be2da0
SHA51249b8af0a1ab02a0482ed27180c64b7ffa01db84c2cc9e9b2c8b90d9155b7895435491fcd6d9c8329fe7283d74aaee51f719fc32f6a5177091ea5a9a313415e5b
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB