Analysis
-
max time kernel
88s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-03-2024 00:19
General
-
Target
d4bc76778aa14165d048727072cb17f3.exe
-
Size
385KB
-
MD5
d4bc76778aa14165d048727072cb17f3
-
SHA1
eccefdff3e33678ddf5a4868202256d2c01c3bbe
-
SHA256
008f6ebfaf206b207cfd1b82e76183e148d750684efa12a41320d19bf80f4a19
-
SHA512
de350d834eb4855ec1db9113ee5dae20735b35bbab08cb3b1b8ad91701c8db33b11d1f3909ec6436c2214bd6393e20cb3c27e735bce28367f5ebf91811ac8f42
-
SSDEEP
12288:X0KnVfTyE2J2Bgqlehqanwz21qCFpGkiSI4BVkoB:EKV7y1J2Cqlgq+z4CHZiysoB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4bc76778aa14165d048727072cb17f3.exe"C:\Users\Admin\AppData\Local\Temp\d4bc76778aa14165d048727072cb17f3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d4bc76778aa14165d048727072cb17f3.exeC:\Users\Admin\AppData\Local\Temp\d4bc76778aa14165d048727072cb17f3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD53810d63b2a967b9eedd806e723d38566
SHA10e6afa174cffec2820c240ab0ecc8e443c21f41c
SHA2568185f67dded6054b5b898eff5759e7c2a3bf387c0dd82a3a6c5cabf9ed3eebdf
SHA5124a8dc2f11e5a2ee9fb15622157e83aa8ad622965a98cb2ce467dfa38c940d06557fe1167bdb14db5bb386c41d97f77b95e1c827c6c4a463c193f1e1d52c4c345
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB