288c2aa37f1ce2b28ce95d1f5ac427c53db716c328a1f103a9689119238f8ccc

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c28286fc44eebd598018e72409aa0d8a.exe
Size

385KB
MD5

c28286fc44eebd598018e72409aa0d8a
SHA1

8d14342faa8e864bde1bbf314da7373d3673fd59
SHA256

288c2aa37f1ce2b28ce95d1f5ac427c53db716c328a1f103a9689119238f8ccc
SHA512

95d49c1d0e6ba24c04470570dc26d31598ed6856a5e5e6805afb5a5a667b71b55506d13ea50b4ac9bfddad6a12f999c2527665c944608b694d9eded72c615398
SSDEEP

12288:Cgef29ChD/jb8Mv1u5/B7uHb5ashTq/S75B:/H9Chz/LcJ765/hTeSVB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1452	c28286fc44eebd598018e72409aa0d8a.exe

Executes dropped EXE 1 IoCs

pid	Process
1452	c28286fc44eebd598018e72409aa0d8a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3828	c28286fc44eebd598018e72409aa0d8a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3828	c28286fc44eebd598018e72409aa0d8a.exe
1452	c28286fc44eebd598018e72409aa0d8a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1452	3828	c28286fc44eebd598018e72409aa0d8a.exe	88
PID 3828 wrote to memory of 1452	3828	c28286fc44eebd598018e72409aa0d8a.exe	88
PID 3828 wrote to memory of 1452	3828	c28286fc44eebd598018e72409aa0d8a.exe	88

C:\Users\Admin\AppData\Local\Temp\c28286fc44eebd598018e72409aa0d8a.exe
"C:\Users\Admin\AppData\Local\Temp\c28286fc44eebd598018e72409aa0d8a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\c28286fc44eebd598018e72409aa0d8a.exe
  C:\Users\Admin\AppData\Local\Temp\c28286fc44eebd598018e72409aa0d8a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c28286fc44eebd598018e72409aa0d8a.exe

Filesize
385KB

MD5
3d5fc3c8a6613c90fad6cb6f8a735b11

SHA1
c9daf240b7d852a0ab825af3f0645220d71b47b9

SHA256
d7051e62fe2d70ad03e413f16dd1c407bdee75a52a5487aabd21bbeb5b5378a8

SHA512
7da078aba3697b0e135091baa671c0cf18dd5177ea89866a864c88751143321402608e2a0a4333e08d2bacd3f7f2c36e47039c5633ed8a19661c021d64911533

Download Submit
memory/1452-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1452-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1452-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/1452-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1452-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1452-34-0x000000000C720000-0x000000000C75C000-memory.dmp

Filesize
240KB

Download
memory/1452-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3828-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3828-1-0x0000000000140000-0x00000000001A6000-memory.dmp

Filesize
408KB

Download
memory/3828-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3828-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download