46ff1a7ed798768ddf852e186f86132e049eda10ff7066844d4b900b0d62b5ed

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b83eda7cbee17364e42e5152b6cc0c58.exe
Size

385KB
MD5

b83eda7cbee17364e42e5152b6cc0c58
SHA1

a405d1a78f8c525b2fd7d09b841f2c1f1fb5fef1
SHA256

46ff1a7ed798768ddf852e186f86132e049eda10ff7066844d4b900b0d62b5ed
SHA512

951afcf09138bc653b615325feb3d8103cb79a83c2c092e9e0cef88e8e7bfcd1aa65f941d68190c2a859049d04220c94b18b170fc9fc23dae85cc0a6e560852a
SSDEEP

6144:/zhPi5v31VOKtttU31Dq145tR6RVDaL1RW1tcXrIB5CCPx624np+iftnwB:VPWv31Ptm1B96RpSRW7cXY5awimB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4584	b83eda7cbee17364e42e5152b6cc0c58.exe

Executes dropped EXE 1 IoCs

pid	Process
4584	b83eda7cbee17364e42e5152b6cc0c58.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2312	b83eda7cbee17364e42e5152b6cc0c58.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2312	b83eda7cbee17364e42e5152b6cc0c58.exe
4584	b83eda7cbee17364e42e5152b6cc0c58.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4584	2312	b83eda7cbee17364e42e5152b6cc0c58.exe	85
PID 2312 wrote to memory of 4584	2312	b83eda7cbee17364e42e5152b6cc0c58.exe	85
PID 2312 wrote to memory of 4584	2312	b83eda7cbee17364e42e5152b6cc0c58.exe	85

C:\Users\Admin\AppData\Local\Temp\b83eda7cbee17364e42e5152b6cc0c58.exe
"C:\Users\Admin\AppData\Local\Temp\b83eda7cbee17364e42e5152b6cc0c58.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\b83eda7cbee17364e42e5152b6cc0c58.exe
  C:\Users\Admin\AppData\Local\Temp\b83eda7cbee17364e42e5152b6cc0c58.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b83eda7cbee17364e42e5152b6cc0c58.exe

Filesize
385KB

MD5
7ca93f0141794b7a52773583640c8025

SHA1
0080971e28fb770d349bf345e17bb5cdc519364b

SHA256
bdb561ac8146c9c25fcabf374347d33e9b0074267405cda9732c6a5e6c566a57

SHA512
bea2d3432eedb9e8641312c6b8590ef21b388a6694302d2e8a067e3eeac26f7e4eb5deba7ba25838d73f51b06c97d9d86faf4607f2f4e0a740482bbecbaf8737

Download Submit
memory/2312-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2312-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/2312-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2312-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4584-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4584-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4584-20-0x00000000015D0000-0x000000000162F000-memory.dmp

Filesize
380KB

Download
memory/4584-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4584-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4584-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4584-38-0x000000000C760000-0x000000000C79C000-memory.dmp

Filesize
240KB

Download
memory/4584-39-0x000000000C760000-0x000000000C79C000-memory.dmp

Filesize
240KB

Download