7b7ffdabadd1e1ea05600f00d17abf7032e65873bc833a50555b7cd8b26c8a17

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mango.exe
Size

1.8MB
MD5

b151f8d7b9dcf80375ba12746289c15b
SHA1

c826226bfd50994b82aa6de2c1acab492cb042bc
SHA256

7b7ffdabadd1e1ea05600f00d17abf7032e65873bc833a50555b7cd8b26c8a17
SHA512

cf03670e1872b2ab0c391289b3db0f0076e575b9ca7ce18aa560669028cfc7d378a25771a08cf53d86e8be15a4f769d2acf84b068e325147f1729a6c387d8ecf
SSDEEP

49152:VxeSA72PbxqYB4hsVXuRjRzeGxqlegrAq:DxA7MEYmy9eZeGVgr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1072	mango.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe
1072	mango.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1072	mango.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	mango.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	mango.exe

C:\Users\Admin\AppData\Local\Temp\mango.exe
"C:\Users\Admin\AppData\Local\Temp\mango.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll

Filesize
142KB

MD5
9c43f77cb7cff27cb47ed67babe3eda5

SHA1
b0400cf68249369d21de86bd26bb84ccffd47c43

SHA256
f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

SHA512
cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

Download Submit
memory/1072-0-0x00007FFC06943000-0x00007FFC06945000-memory.dmp

Filesize
8KB

Download
memory/1072-1-0x0000014DF9F80000-0x0000014DFA146000-memory.dmp

Filesize
1.8MB

Download
memory/1072-2-0x0000014DFC7E0000-0x0000014DFC9B4000-memory.dmp

Filesize
1.8MB

Download
memory/1072-3-0x0000014DFC9C0000-0x0000014DFCB68000-memory.dmp

Filesize
1.7MB

Download
memory/1072-4-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-15-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-17-0x00007FFC16250000-0x00007FFC16277000-memory.dmp

Filesize
156KB

Download
memory/1072-12-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-11-0x00007FFC15590000-0x00007FFC156DE000-memory.dmp

Filesize
1.3MB

Download
memory/1072-13-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-20-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-30-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-52-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-72-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-74-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-70-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-68-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-66-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-64-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-62-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-60-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-58-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-56-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-54-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-50-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-48-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-46-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-42-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-40-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-44-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-38-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-36-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-34-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-32-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-28-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-26-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-24-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-22-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-18-0x0000014DFC9C0000-0x0000014DFCB64000-memory.dmp

Filesize
1.6MB

Download
memory/1072-11027-0x0000014DFA640000-0x0000014DFA650000-memory.dmp

Filesize
64KB

Download
memory/1072-11028-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11029-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11030-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11031-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11032-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11033-0x00007FFC06943000-0x00007FFC06945000-memory.dmp

Filesize
8KB

Download
memory/1072-11034-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11035-0x00007FFC16250000-0x00007FFC16277000-memory.dmp

Filesize
156KB

Download
memory/1072-11036-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11037-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11038-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11039-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download
memory/1072-11040-0x00007FFC06940000-0x00007FFC07401000-memory.dmp

Filesize
10.8MB

Download