b4498a277853f921620fa625520bc892d13560fe8358c8e61765dac97beb41c7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c627edcb68bee45e1ebc2dfe1fceb774.exe
Size

385KB
MD5

c627edcb68bee45e1ebc2dfe1fceb774
SHA1

4c4c4e616226274d5f509be27ed6be2d91227324
SHA256

b4498a277853f921620fa625520bc892d13560fe8358c8e61765dac97beb41c7
SHA512

6a3e1a267bed9faf694d2034d7b1547d420d200371f748fb8529804debe9b98e7e451dcf1e2fa640b5e3bf97d6dd7575e109a13000ba7f3bbefa30f284c20d14
SSDEEP

12288:7U//iy2THAs1Mub95CSaHnnscyH4oytLng/o4ny9ASUNB:7UyNTHAYMuaS6pMS99UNB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2224	c627edcb68bee45e1ebc2dfe1fceb774.exe

Executes dropped EXE 1 IoCs

pid	Process
2224	c627edcb68bee45e1ebc2dfe1fceb774.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
16	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3988	c627edcb68bee45e1ebc2dfe1fceb774.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3988	c627edcb68bee45e1ebc2dfe1fceb774.exe
2224	c627edcb68bee45e1ebc2dfe1fceb774.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2224	3988	c627edcb68bee45e1ebc2dfe1fceb774.exe	88
PID 3988 wrote to memory of 2224	3988	c627edcb68bee45e1ebc2dfe1fceb774.exe	88
PID 3988 wrote to memory of 2224	3988	c627edcb68bee45e1ebc2dfe1fceb774.exe	88

C:\Users\Admin\AppData\Local\Temp\c627edcb68bee45e1ebc2dfe1fceb774.exe
"C:\Users\Admin\AppData\Local\Temp\c627edcb68bee45e1ebc2dfe1fceb774.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\c627edcb68bee45e1ebc2dfe1fceb774.exe
  C:\Users\Admin\AppData\Local\Temp\c627edcb68bee45e1ebc2dfe1fceb774.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c627edcb68bee45e1ebc2dfe1fceb774.exe

Filesize
385KB

MD5
fccaed1c55f60a8a79824f7ab9748dc0

SHA1
7ece9b6e60459b8b87eec583843a3dcdc07b350f

SHA256
14761d393c5ebf0d778f303c6cfa6d82d4a0cd940d5d64c22ee0b47b1ba314fd

SHA512
88bc7ee1e42aacd777a48a3c6a23f8a034ee3195ad25792133e2ee7859947eee68c055b79fe1d09851a67dbdef430cda81dfb07eeb218c5cb9b2df73eda8ca1a

Download Submit
memory/2224-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2224-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2224-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2224-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

Filesize
380KB

Download
memory/2224-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2224-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2224-36-0x000000000B5F0000-0x000000000B62C000-memory.dmp

Filesize
240KB

Download
memory/2224-37-0x000000000B5F0000-0x000000000B62C000-memory.dmp

Filesize
240KB

Download
memory/3988-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3988-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3988-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3988-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download