377ec98e69503eaa487c2f596749e8379bb8a53e77c9d9e16ab65b2e1007dece

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b62aa3200492928acf24c993fd15bd13.exe
Size

385KB
MD5

b62aa3200492928acf24c993fd15bd13
SHA1

1d465d55def88053410fd3d6605cc63bbf451e74
SHA256

377ec98e69503eaa487c2f596749e8379bb8a53e77c9d9e16ab65b2e1007dece
SHA512

52e8a76dd3ab43f432eedac96d57662fd331616b82d5f9041b439faa7fd37965483dcfc600f5d52a3dc2b9f79119e206111ab42083a04c475974a0c9fcbef2a3
SSDEEP

12288:FZfpfH7pymu64fO4ixXUj2yF71nuKcunW0V7tIB:jpfH7pymxYO4wUjNt1VJV7tIB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	b62aa3200492928acf24c993fd15bd13.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	b62aa3200492928acf24c993fd15bd13.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com
12	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	b62aa3200492928acf24c993fd15bd13.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1648	b62aa3200492928acf24c993fd15bd13.exe
2692	b62aa3200492928acf24c993fd15bd13.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2692	1648	b62aa3200492928acf24c993fd15bd13.exe	90
PID 1648 wrote to memory of 2692	1648	b62aa3200492928acf24c993fd15bd13.exe	90
PID 1648 wrote to memory of 2692	1648	b62aa3200492928acf24c993fd15bd13.exe	90

C:\Users\Admin\AppData\Local\Temp\b62aa3200492928acf24c993fd15bd13.exe
"C:\Users\Admin\AppData\Local\Temp\b62aa3200492928acf24c993fd15bd13.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\b62aa3200492928acf24c993fd15bd13.exe
  C:\Users\Admin\AppData\Local\Temp\b62aa3200492928acf24c993fd15bd13.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b62aa3200492928acf24c993fd15bd13.exe

Filesize
385KB

MD5
073f41b81cb74a02378d439d117a275a

SHA1
0a7baa9af8a3e8a684298b70947f770a002006f3

SHA256
4a6b4f3c19b4b221be98ff5f02a39106c655d1c0fba5d0da3eb93c777f6da6ee

SHA512
e1ba729ebcd6aa01bb8b969060f07b87828324f65752e33ace16fa700c6d7271180bfa6c2688f34fe5eede65efb32699e4232ff7e26bd57269ef4f23a60b49dd

Download Submit
memory/1648-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1648-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1648-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1648-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2692-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2692-14-0x0000000001620000-0x0000000001686000-memory.dmp

Filesize
408KB

Download
memory/2692-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/2692-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2692-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2692-35-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/2692-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download