Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 02:12
General
-
Target
d4f50b269f9adcc1f2283ceef81bb736.exe
-
Size
771KB
-
MD5
d4f50b269f9adcc1f2283ceef81bb736
-
SHA1
8a067e4fab24a3826863d3487618d48ec3e59a6b
-
SHA256
82d704a625dab13592c38fda920c75bb9c99c3ff37bfabbac06358ef57c059c0
-
SHA512
cae880f46619fe8660449ffadaa07bf21e2253e38f3485f516edb3a1220ee75cba5eb4dde37d9c40a5370aac61e446ba48959d17b53e183eaa80d307bc5b6799
-
SSDEEP
12288:5iPUg0CbBiwElUeY+JokUHnB6JOQ1pb10VHmDXTuFaa2AtyGTKOF25ZoJJyhRgeG:fCbBvdCIH21pb10hJaothZ2/T6FBBB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f50b269f9adcc1f2283ceef81bb736.exe"C:\Users\Admin\AppData\Local\Temp\d4f50b269f9adcc1f2283ceef81bb736.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d4f50b269f9adcc1f2283ceef81bb736.exeC:\Users\Admin\AppData\Local\Temp\d4f50b269f9adcc1f2283ceef81bb736.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771KB
MD555cff75f92cbeb72dd93a1070869909b
SHA14e9db495f7195d6f551bda2d0fec496d73078aaf
SHA256c6480d58b5699a029618003af4a3e5c9bd235b0111f7eede5c567b89e557752c
SHA5128802d83b515667bcc23d6fa613acb1bb7d2cb48b9a3f2352c13c9f2d089ed181cda69ba0eb79fe6ce56ced32bdd02cfd89cd90332921dc109d7e889023460834
-
Filesize
56KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB