dbbc995f62325b5b22e3a299c831fb04e2a9d503c513bbc00d98418c1e6a4f59

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8952aab0fc171a3b2ffc45eb307a9376.exe
Size

385KB
MD5

8952aab0fc171a3b2ffc45eb307a9376
SHA1

01f113b0da09000a948488804db029c2d03441d3
SHA256

dbbc995f62325b5b22e3a299c831fb04e2a9d503c513bbc00d98418c1e6a4f59
SHA512

d970c01c4b8ec3ea42aa2ee7e37f328f3112a89193d17edcc38e886897f961fcb1ef9f120be00d6fcfc7824675606c6c7600b1ef7973cdd3923d242aca2b0930
SSDEEP

6144:7oNQL+gB+Kp/oj3nED6VYEZvrfj+I9bZaWDDTelUYCgiWyLejiB:UQLVBF/ogWVYEJr79bZaAiaTWggiB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3196	8952aab0fc171a3b2ffc45eb307a9376.exe

Executes dropped EXE 1 IoCs

pid	Process
3196	8952aab0fc171a3b2ffc45eb307a9376.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3308	8952aab0fc171a3b2ffc45eb307a9376.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3308	8952aab0fc171a3b2ffc45eb307a9376.exe
3196	8952aab0fc171a3b2ffc45eb307a9376.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3196	3308	8952aab0fc171a3b2ffc45eb307a9376.exe	84
PID 3308 wrote to memory of 3196	3308	8952aab0fc171a3b2ffc45eb307a9376.exe	84
PID 3308 wrote to memory of 3196	3308	8952aab0fc171a3b2ffc45eb307a9376.exe	84

C:\Users\Admin\AppData\Local\Temp\8952aab0fc171a3b2ffc45eb307a9376.exe
"C:\Users\Admin\AppData\Local\Temp\8952aab0fc171a3b2ffc45eb307a9376.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\8952aab0fc171a3b2ffc45eb307a9376.exe
  C:\Users\Admin\AppData\Local\Temp\8952aab0fc171a3b2ffc45eb307a9376.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8952aab0fc171a3b2ffc45eb307a9376.exe

Filesize
384KB

MD5
3b5fdf340e8a7426f11b28fdc68febc4

SHA1
216c2ea16bce48ca98fbb4fa6adb6b27a7c5c30a

SHA256
b788c04d6157afeee63dac8b525cbc8d4f31c9f31486fb0f46589eaf58986746

SHA512
45533f679dc8dfd7326684c24eb8b210455124d62f75832677145a1e2a4b283cd80f30aa9b4b9e9becdcab6297a12cd7108ae025c79489287473a0a648194807

Download Submit
memory/3196-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3196-16-0x0000000001540000-0x00000000015A6000-memory.dmp

Filesize
408KB

Download
memory/3196-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/3196-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3196-31-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/3196-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3196-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3308-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3308-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3308-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3308-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download