Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 00:15

General

  • Target

    97fc8763592eb7f6fb56f15f6bd02362.exe

  • Size

    385KB

  • MD5

    97fc8763592eb7f6fb56f15f6bd02362

  • SHA1

    247970134c27a6259be6c7603a869b91eb5f4f4c

  • SHA256

    fb2466c612cd158cda2a3345354d746df248bfdd6db3a905527b838e39051f92

  • SHA512

    96a0a53ce3e175e9b32e8930dbe72defc26c3bf9112c4fc1cde7000f82e096631a88c8e721c6e3c8db0344aab3545e5030159ba4b309076c23b1ce8bda61d5eb

  • SSDEEP

    12288:fQXNPo6gyFc++y3KEQYa90CwtURRwMMJVmB:oXNQ1yl+y6EQ3+CTRkwB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe
    "C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe
      C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe

    Filesize

    385KB

    MD5

    d535f16821be9b35ba9c6fc91ae42edf

    SHA1

    54db593750ea5eb5091e1a945ee1c7569f84d2d8

    SHA256

    10863ab4c27583d9b104c7aebce8b7fb5020148fee6dcefc48ab2a4cd6b2fade

    SHA512

    5bd3d7ca66e6370cac04bebffa9b551d639b4f60d298625a680e3c5bc168109dd63e326f43c03d0366c4ac2df7b1369496f1d9750431f5099d78a33d33ce094f

  • memory/1556-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1556-14-0x0000000001470000-0x00000000014D6000-memory.dmp

    Filesize

    408KB

  • memory/1556-20-0x00000000015D0000-0x000000000162F000-memory.dmp

    Filesize

    380KB

  • memory/1556-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1556-31-0x00000000052F0000-0x000000000532C000-memory.dmp

    Filesize

    240KB

  • memory/1556-30-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1556-36-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/5056-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/5056-1-0x00000000014D0000-0x0000000001536000-memory.dmp

    Filesize

    408KB

  • memory/5056-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/5056-11-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB