775a8a9ee63a5c5ea4cab19d36eff4fc66afaef87bd63634b80f05c78dcf08c2

Analysis

max time kernel
87s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9afb9ce022cad4df1d2b3ccf73056e02.exe
Size

385KB
MD5

9afb9ce022cad4df1d2b3ccf73056e02
SHA1

a3dd036e13405643618f8245be98ca461b6ed398
SHA256

775a8a9ee63a5c5ea4cab19d36eff4fc66afaef87bd63634b80f05c78dcf08c2
SHA512

0a996d13e4dde2f036d4d2d72edeafbef47a4d1310371259f87333165666110185e9e6d1a4d9485c8743771f6e8732356e511fc053f2d5fe0b518695cdbb93a3
SSDEEP

12288:NdCwExTCG/XBV5rKQroUIxrNW9TeHONzC9s/B:NobZXB/KQroUI6TecR/B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3924	9afb9ce022cad4df1d2b3ccf73056e02.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	9afb9ce022cad4df1d2b3ccf73056e02.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4116	9afb9ce022cad4df1d2b3ccf73056e02.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4116	9afb9ce022cad4df1d2b3ccf73056e02.exe
3924	9afb9ce022cad4df1d2b3ccf73056e02.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3924	4116	9afb9ce022cad4df1d2b3ccf73056e02.exe	84
PID 4116 wrote to memory of 3924	4116	9afb9ce022cad4df1d2b3ccf73056e02.exe	84
PID 4116 wrote to memory of 3924	4116	9afb9ce022cad4df1d2b3ccf73056e02.exe	84

C:\Users\Admin\AppData\Local\Temp\9afb9ce022cad4df1d2b3ccf73056e02.exe
"C:\Users\Admin\AppData\Local\Temp\9afb9ce022cad4df1d2b3ccf73056e02.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\9afb9ce022cad4df1d2b3ccf73056e02.exe
  C:\Users\Admin\AppData\Local\Temp\9afb9ce022cad4df1d2b3ccf73056e02.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9afb9ce022cad4df1d2b3ccf73056e02.exe

Filesize
385KB

MD5
cbe6d78b280e7e3aa412d170754abbfb

SHA1
bc602a7a5276bef78083c71c28e902e7c9f9e1c9

SHA256
ae26b85f6f0e7b8336cf989221f4ca34bfc7454a5a68c362088f9f3de6ff89f7

SHA512
15f8da328ad51e2696695184e64a31b681773d6c4ffb2f7636d1e993b3384f4861c3f7db0c403e87bd3d68bb4381bd73494579c48b03b449dc78f5436bd183f9

Download Submit
memory/3924-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3924-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3924-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3924-22-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

Filesize
380KB

Download
memory/3924-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3924-33-0x000000000B620000-0x000000000B65C000-memory.dmp

Filesize
240KB

Download
memory/3924-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4116-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4116-1-0x0000000001610000-0x0000000001676000-memory.dmp

Filesize
408KB

Download
memory/4116-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4116-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download