ba7213941d57e1d2385c9b310d3188fe1f7384d9bbd649cb7aa9cfb2885021f8

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8ca888dc952a15e60c707d45100baaf.exe
Size

385KB
MD5

b8ca888dc952a15e60c707d45100baaf
SHA1

1c1951271bdb44810c05b2b021ecd6aab28e2560
SHA256

ba7213941d57e1d2385c9b310d3188fe1f7384d9bbd649cb7aa9cfb2885021f8
SHA512

47b681846c9c59c54ec930f486ac1215654675fbc43a8c3651852c02c52b619853939360c2cc15237d84f52baa097da9606fdab1bc379cf950f08133e4ed4c54
SSDEEP

12288:RZR9j8b5EEHG9kUrVleKAT6QDViCAQfgC8B:jR94+Osz1yDViCAoV8B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1664	b8ca888dc952a15e60c707d45100baaf.exe

Executes dropped EXE 1 IoCs

pid	Process
1664	b8ca888dc952a15e60c707d45100baaf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
10	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
212	b8ca888dc952a15e60c707d45100baaf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
212	b8ca888dc952a15e60c707d45100baaf.exe
1664	b8ca888dc952a15e60c707d45100baaf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 1664	212	b8ca888dc952a15e60c707d45100baaf.exe	89
PID 212 wrote to memory of 1664	212	b8ca888dc952a15e60c707d45100baaf.exe	89
PID 212 wrote to memory of 1664	212	b8ca888dc952a15e60c707d45100baaf.exe	89

C:\Users\Admin\AppData\Local\Temp\b8ca888dc952a15e60c707d45100baaf.exe
"C:\Users\Admin\AppData\Local\Temp\b8ca888dc952a15e60c707d45100baaf.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\b8ca888dc952a15e60c707d45100baaf.exe
  C:\Users\Admin\AppData\Local\Temp\b8ca888dc952a15e60c707d45100baaf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b8ca888dc952a15e60c707d45100baaf.exe

Filesize
385KB

MD5
44f13a314d9a37468004b462448bf82b

SHA1
aa30b92a1bbc83b9d0b2289ad07dbe7ab0f7d82d

SHA256
6fbac1d032ed8b6086c090a8eb367f1af0caaec985936a20c0e39b5548dd7a76

SHA512
5fcb639b0092072af77b1668ce29c1cc43679a7c6460c279d963ba5488a2f84cdfe1ede00d117d49de9172cad3f222c3c5140b3abf8d8bbe9af49fd40bdf8c04

Download Submit
memory/212-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/212-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/212-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/212-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1664-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1664-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1664-20-0x0000000001630000-0x000000000168F000-memory.dmp

Filesize
380KB

Download
memory/1664-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1664-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1664-32-0x000000000C640000-0x000000000C67C000-memory.dmp

Filesize
240KB

Download
memory/1664-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download