a798fa4e66eea514535e574866eda9f77bd48269ce9ee1a45a00b5d56618dbd5

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b5844a6e214d41e98b0c3a20e70f2c4.exe
Size

385KB
MD5

9b5844a6e214d41e98b0c3a20e70f2c4
SHA1

20f0fd12955c28924a9202102065c4c87507ed75
SHA256

a798fa4e66eea514535e574866eda9f77bd48269ce9ee1a45a00b5d56618dbd5
SHA512

97e133b4d2dd94e5c890865bdd56768ba5fe454a79a49727d11c42187144196e570e6c3f52f69ed1589d501568db4758964f2e326b9f93db444f456d59febd75
SSDEEP

6144:9anRwzCHRkIp2lj0ThZrR6ea4V3RMxOM92OEvcwSMnevUeNWpEwGuB:9JCHuI8aT3rDa5OM92OWcwpnLeQbB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1364	9b5844a6e214d41e98b0c3a20e70f2c4.exe

Executes dropped EXE 1 IoCs

pid	Process
1364	9b5844a6e214d41e98b0c3a20e70f2c4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4400	9b5844a6e214d41e98b0c3a20e70f2c4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4400	9b5844a6e214d41e98b0c3a20e70f2c4.exe
1364	9b5844a6e214d41e98b0c3a20e70f2c4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1364	4400	9b5844a6e214d41e98b0c3a20e70f2c4.exe	86
PID 4400 wrote to memory of 1364	4400	9b5844a6e214d41e98b0c3a20e70f2c4.exe	86
PID 4400 wrote to memory of 1364	4400	9b5844a6e214d41e98b0c3a20e70f2c4.exe	86

C:\Users\Admin\AppData\Local\Temp\9b5844a6e214d41e98b0c3a20e70f2c4.exe
"C:\Users\Admin\AppData\Local\Temp\9b5844a6e214d41e98b0c3a20e70f2c4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\9b5844a6e214d41e98b0c3a20e70f2c4.exe
  C:\Users\Admin\AppData\Local\Temp\9b5844a6e214d41e98b0c3a20e70f2c4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9b5844a6e214d41e98b0c3a20e70f2c4.exe

Filesize
385KB

MD5
d0e6511ed0b895f9b9f2a1428b772e83

SHA1
ab9fb3aa9d34ae2f5d250ae8147ffc8f4c7711c3

SHA256
c8ed76ad7036208dd7f5f0495abec154d7cbdff583eff809060621cc65d0aee5

SHA512
a1dabe1f3c43bcf801d3bbc6ea6e43c63266e42060993b0d295ad260e5e69b6f23370a9583ecab068a58653a68b8b65b2b290dd3faff340665a3d0edb3650176

Download Submit
memory/1364-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1364-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1364-15-0x00000000015F0000-0x0000000001656000-memory.dmp

Filesize
408KB

Download
memory/1364-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

Filesize
380KB

Download
memory/1364-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1364-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1364-38-0x000000000D660000-0x000000000D69C000-memory.dmp

Filesize
240KB

Download
memory/1364-39-0x000000000D660000-0x000000000D69C000-memory.dmp

Filesize
240KB

Download
memory/4400-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4400-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4400-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4400-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download