2d7637535379c69a825a452a0376f2f283448d44e2078ea14d947d7c186ccd3e

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8795e406982147ed0af376e985f53e66.exe
Size

385KB
MD5

8795e406982147ed0af376e985f53e66
SHA1

809fd7047c36a1a17adc2670b59d68e8132214e2
SHA256

2d7637535379c69a825a452a0376f2f283448d44e2078ea14d947d7c186ccd3e
SHA512

e07a785607b044d249c25d7187c528580c83c6943d6a35ee56afe3ac173877440a71bb809275f32422b4dcdb023cebae71fc3d0979dcdc96a5572aad8ec656ac
SSDEEP

6144:Rxq6V1u8pQD/xQezlrlnCzkyP99vR0GvCpOVGgTKfgNqWESRMgYLB:rq6y8pQtQezvnCIyvc6xR5iB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1012	8795e406982147ed0af376e985f53e66.exe

Executes dropped EXE 1 IoCs

pid	Process
1012	8795e406982147ed0af376e985f53e66.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4260	8795e406982147ed0af376e985f53e66.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4260	8795e406982147ed0af376e985f53e66.exe
1012	8795e406982147ed0af376e985f53e66.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1012	4260	8795e406982147ed0af376e985f53e66.exe	84
PID 4260 wrote to memory of 1012	4260	8795e406982147ed0af376e985f53e66.exe	84
PID 4260 wrote to memory of 1012	4260	8795e406982147ed0af376e985f53e66.exe	84

C:\Users\Admin\AppData\Local\Temp\8795e406982147ed0af376e985f53e66.exe
"C:\Users\Admin\AppData\Local\Temp\8795e406982147ed0af376e985f53e66.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\8795e406982147ed0af376e985f53e66.exe
  C:\Users\Admin\AppData\Local\Temp\8795e406982147ed0af376e985f53e66.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8795e406982147ed0af376e985f53e66.exe

Filesize
385KB

MD5
904d6b631d79b9c36ca676d433ec62e0

SHA1
b526f899a44130e251586c9b9c8b7106981d5b11

SHA256
41fe3d4a41903d654feb08b6f6eb41b8c9705ebc4486c0c0794377ffbf8609b9

SHA512
e519c5640b4fe8b76456c6afc0806f95f8b6a095c276e9ef4320be27620278fa014905f66583fe9286fc4db18f9e29dd2f5691449b9a5395df69ba4ce2b82b0e

Download Submit
memory/1012-15-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/1012-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1012-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/1012-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1012-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1012-33-0x000000000C620000-0x000000000C65C000-memory.dmp

Filesize
240KB

Download
memory/1012-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4260-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4260-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4260-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4260-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download