2dd977e7a75515b48217f31b67aa4f519f9029e8ad295e63215419f09f29957c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8dee86efce7c34f7379bc8ade9ca34f.exe
Size

385KB
MD5

c8dee86efce7c34f7379bc8ade9ca34f
SHA1

0f183d3bbc171f55206b6742092ead0925912f8c
SHA256

2dd977e7a75515b48217f31b67aa4f519f9029e8ad295e63215419f09f29957c
SHA512

15d2fd6cd4ee50b394fca2aed67da99cae947a1150d7bbf91248925b172b61e9301b400e6e49d0c6bedc539363bbb3b1dad9b7d7c55f2b139c2d95a6f99accab
SSDEEP

6144:zicn8zZlMf+6kwcb3m8fWZjDCNjubj1XrCymX//IB+ZTaP6AbmD/+kMwqG138B:zicn8zNwChLjuZCyQErS0mbhMA98B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1136	c8dee86efce7c34f7379bc8ade9ca34f.exe

Executes dropped EXE 1 IoCs

pid	Process
1136	c8dee86efce7c34f7379bc8ade9ca34f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
10	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3408	c8dee86efce7c34f7379bc8ade9ca34f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3408	c8dee86efce7c34f7379bc8ade9ca34f.exe
1136	c8dee86efce7c34f7379bc8ade9ca34f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1136	3408	c8dee86efce7c34f7379bc8ade9ca34f.exe	88
PID 3408 wrote to memory of 1136	3408	c8dee86efce7c34f7379bc8ade9ca34f.exe	88
PID 3408 wrote to memory of 1136	3408	c8dee86efce7c34f7379bc8ade9ca34f.exe	88

C:\Users\Admin\AppData\Local\Temp\c8dee86efce7c34f7379bc8ade9ca34f.exe
"C:\Users\Admin\AppData\Local\Temp\c8dee86efce7c34f7379bc8ade9ca34f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\c8dee86efce7c34f7379bc8ade9ca34f.exe
  C:\Users\Admin\AppData\Local\Temp\c8dee86efce7c34f7379bc8ade9ca34f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c8dee86efce7c34f7379bc8ade9ca34f.exe

Filesize
64KB

MD5
4ba7c8e4d838c30f8cf0434a00eee035

SHA1
4b2245a5281bfec6118235398dbff99f285d691f

SHA256
1a3ae5d1ce6305bf72f5842e9aea410168d0c735373f06fba03f20399efa4cca

SHA512
4b66366b2f1cda238411d96b9fbdb30ff2de44f2d106e3331f2ebb8673aaefe6c64d58a46eb1e81b3649cfb34fef10a4056a2557f47cd61cc44632cd84a7ff2c

Download Submit
memory/1136-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1136-16-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/1136-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

Filesize
380KB

Download
memory/1136-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1136-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1136-37-0x000000000B620000-0x000000000B65C000-memory.dmp

Filesize
240KB

Download
memory/1136-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3408-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3408-1-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/3408-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3408-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download