0c3c8fefef947757693a62a68692be148c7406d293b00587205021ccdfce1cd8

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67429a8538315e932d5b32c0f7d64a80.exe
Size

9.0MB
MD5

67429a8538315e932d5b32c0f7d64a80
SHA1

946416296f85819b90604b39cc4e97ebdfaf385c
SHA256

0c3c8fefef947757693a62a68692be148c7406d293b00587205021ccdfce1cd8
SHA512

b6140bf1c59c0d6bca00c4437d0198443c724c7329d5f8076f2094f2b5178f64b9f166657240e3047f65c30277aaafdf2415b46312a4bc566da61af68c2219e9
SSDEEP

196608:D28XMb4nZp3JCKb4nZp3Pd9tgKuwePlZ:D2tOp3AKOp3P3luwez

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1984	67429a8538315e932d5b32c0f7d64a80.exe

Executes dropped EXE 1 IoCs

pid	Process
1984	67429a8538315e932d5b32c0f7d64a80.exe

Loads dropped DLL 1 IoCs

pid	Process
1848	67429a8538315e932d5b32c0f7d64a80.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1984	67429a8538315e932d5b32c0f7d64a80.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1848	67429a8538315e932d5b32c0f7d64a80.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1984	67429a8538315e932d5b32c0f7d64a80.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1984	1848	67429a8538315e932d5b32c0f7d64a80.exe	29
PID 1848 wrote to memory of 1984	1848	67429a8538315e932d5b32c0f7d64a80.exe	29
PID 1848 wrote to memory of 1984	1848	67429a8538315e932d5b32c0f7d64a80.exe	29
PID 1848 wrote to memory of 1984	1848	67429a8538315e932d5b32c0f7d64a80.exe	29

C:\Users\Admin\AppData\Local\Temp\67429a8538315e932d5b32c0f7d64a80.exe
"C:\Users\Admin\AppData\Local\Temp\67429a8538315e932d5b32c0f7d64a80.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\67429a8538315e932d5b32c0f7d64a80.exe
  C:\Users\Admin\AppData\Local\Temp\67429a8538315e932d5b32c0f7d64a80.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67429a8538315e932d5b32c0f7d64a80.exe

Filesize
9.0MB

MD5
b7fbad1a78fe5cb6bad84a974bf7d8b9

SHA1
a38355de99db85f0074fd9d15160d549f8474fb5

SHA256
203d7d64a1a78cda146c38f23c3eb8a95285de268f03d40d104b43d15915f815

SHA512
24c00f5644a9b5c94c6f83d5ee4eaa17c54500306f1ba23c8dc1f190276107e3c9130658296712efb996efa6dce7ea6ca4551bd2f023b50ae02114f60e7f7af0

Download Submit
memory/1848-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1848-10-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1848-8-0x00000000037E0000-0x00000000038ED000-memory.dmp

Filesize
1.1MB

Download
memory/1984-18-0x0000000002F20000-0x000000000302D000-memory.dmp

Filesize
1.1MB

Download
memory/1984-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1984-11-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/1984-34-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1984-40-0x000000000FD80000-0x000000000FE23000-memory.dmp

Filesize
652KB

Download