66b17c34e4b21acc273a7f62253606aff32bfde2bdae054e2d70f8ca76a7c702

Analysis

max time kernel
88s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c62009b1faa1b3c4b99e04f5e6ae3f45.exe
Size

385KB
MD5

c62009b1faa1b3c4b99e04f5e6ae3f45
SHA1

26e3fb5621d7ce06c981600d865820d0dda911c3
SHA256

66b17c34e4b21acc273a7f62253606aff32bfde2bdae054e2d70f8ca76a7c702
SHA512

624a802ef641b75d1c034b6f58194ac82c3c722e2be7d1527e1c659e9fe672a2d4cfa1be45746a4d2a97173d7428046192cf6cc1a539d78d912a1f8abed1809d
SSDEEP

12288:XDBcEd40Wth/s7QCDG7RFLq1YV/0TJZTIGB:Xt4iD+qTTJaGB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4040	c62009b1faa1b3c4b99e04f5e6ae3f45.exe

Executes dropped EXE 1 IoCs

pid	Process
4040	c62009b1faa1b3c4b99e04f5e6ae3f45.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
5	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1952	c62009b1faa1b3c4b99e04f5e6ae3f45.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1952	c62009b1faa1b3c4b99e04f5e6ae3f45.exe
4040	c62009b1faa1b3c4b99e04f5e6ae3f45.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4040	1952	c62009b1faa1b3c4b99e04f5e6ae3f45.exe	85
PID 1952 wrote to memory of 4040	1952	c62009b1faa1b3c4b99e04f5e6ae3f45.exe	85
PID 1952 wrote to memory of 4040	1952	c62009b1faa1b3c4b99e04f5e6ae3f45.exe	85

C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe
"C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe
  C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe

Filesize
385KB

MD5
bb66ad068ae53629a5b529d838b9d547

SHA1
94c035ce543e1dca39bf58928ab2b3247d0309b1

SHA256
49a7813389a51359afe44036ec3334ba8892a353912d74e940508761877d3006

SHA512
efada4f8f5b5b9fd1432fee653877eb39f0f57c16b9880293cf07de56ff749da5d2aaedf9da25e07c01cf7436138a490f0842488c1f13a5849bea67f8896e4f8

Download Submit
memory/1952-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1952-1-0x00000000015E0000-0x0000000001646000-memory.dmp

Filesize
408KB

Download
memory/1952-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1952-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4040-14-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4040-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4040-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4040-26-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

Filesize
380KB

Download
memory/4040-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4040-38-0x000000000E6A0000-0x000000000E6DC000-memory.dmp

Filesize
240KB

Download
memory/4040-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download