db741ec3f31b3502200652b198c3e693668980cb47f53ffca3f4d3fc59b1da5c

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c843281523eb16e32fd9c918c6154606.exe
Size

385KB
MD5

c843281523eb16e32fd9c918c6154606
SHA1

337dfdad1b9b471e95025f4bb7279da2fd5a93ee
SHA256

db741ec3f31b3502200652b198c3e693668980cb47f53ffca3f4d3fc59b1da5c
SHA512

b44a9a606907d3c0f820269fe96ebf5e140178a715d0c103b02f9c2f8957793924a2095b59e9ee1fdcd4dd038e1ee203d6b5309d0a448f5ee5a2fdcd7621d26c
SSDEEP

6144:8K+0L4Lvqq/efpOfkW2UKdOBPs79M1hiF6KzeIyqOBo1bualVPpLXWV0luxCwBd8:Y0evfeRlKSSPba4Iy1mtZXWV0yCTB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2080	c843281523eb16e32fd9c918c6154606.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	c843281523eb16e32fd9c918c6154606.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	pastebin.com
13	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3928	c843281523eb16e32fd9c918c6154606.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3928	c843281523eb16e32fd9c918c6154606.exe
2080	c843281523eb16e32fd9c918c6154606.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2080	3928	c843281523eb16e32fd9c918c6154606.exe	90
PID 3928 wrote to memory of 2080	3928	c843281523eb16e32fd9c918c6154606.exe	90
PID 3928 wrote to memory of 2080	3928	c843281523eb16e32fd9c918c6154606.exe	90

C:\Users\Admin\AppData\Local\Temp\c843281523eb16e32fd9c918c6154606.exe
"C:\Users\Admin\AppData\Local\Temp\c843281523eb16e32fd9c918c6154606.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\c843281523eb16e32fd9c918c6154606.exe
  C:\Users\Admin\AppData\Local\Temp\c843281523eb16e32fd9c918c6154606.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c843281523eb16e32fd9c918c6154606.exe

Filesize
385KB

MD5
d09f417ed0ca093bf2940551c5a393cf

SHA1
0e40bfe460e6f7ff86b6d7cbf2ac1cf4978ce7a4

SHA256
7e5c7c567fe35837d8d7b72a91cef4c851a071922cb2bc4168c0f6383fbbe2ae

SHA512
1506a581a6c47bdd59650de8a0b6713586fb459d6cf911c96d2b863ce51dd9e5377a82ae834329d21aeb0bcdb6ceeff41bddf5ad1e1101aa44fa2ec1562c578f

Download Submit
memory/2080-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2080-15-0x0000000000180000-0x00000000001E6000-memory.dmp

Filesize
408KB

Download
memory/2080-20-0x0000000004F20000-0x0000000004F7F000-memory.dmp

Filesize
380KB

Download
memory/2080-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2080-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2080-33-0x000000000B600000-0x000000000B63C000-memory.dmp

Filesize
240KB

Download
memory/2080-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3928-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3928-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3928-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3928-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download