061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
Size 1.4MB
Sample240527-w3vbtadc21
SHA256 061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69
MD5 463448f8da60ce6ad9591f7f970146be
SHA1 4be5de8ca3b32d1f08e218dea121fab9f8b3a7aa
SHA512 9439a929e532bbcf27f21308cb04e1d47292a6004141c27cdfbdc8c8dc254dd6e4c8acc169dc13077de90ced858719615d646823211e1a06137afc4f6a32c275
SSDEEP 24576:Op3w4HcXSyggL9LSZd0a/ZSa77sFZTDleyJohauNb0XGjm:Op3wFCyg600gFghcyJokuN4XGjm
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/2064-10-0x0000000000400000-0x00000000004A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/2064-38-0x0000000007710000-0x00000000077B3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Deletes itself 1 IoCs

pid	Process
2064	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2064	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2064	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2064	2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	29
PID 2924 wrote to memory of 2064	2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	29
PID 2924 wrote to memory of 2064	2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	29
PID 2924 wrote to memory of 2064	2924	061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe	29

C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
"C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
  C:\Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe

Path \Users\Admin\AppData\Local\Temp\061399e37b603b262873721fb3ba658efcb981368d80501ca29c41be0c406c69.exe
Size 1.4MB
SHA256 cc082b6517a353f96824b17bf40f63ebdd1b3141dc09385e65eef826a0bcfb6b
MD5 ebaa937f607f8c38e63cdbe1a4f19d3b
SHA1 1b36d071cad646b504e47037498bf6fc5a5a61ef
SHA512 c60f3410967c12c9116c826f7e0d7e0fcfb6bb953a356b577f8aa9bf0c80752ded95541d4425ac677a29f0f08238f1d89dde1120776b075264a71c08c47cb8e6
SSDEEP 24576:Tu+CQjdETj4CJKzWsrF3Wbha/ZSa77sFZTDleyJohauNb0XGjm:Tu8jdEf4LtlW1gFghcyJokuN4XGjm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2064-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2064-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2064-16-0x0000000002E70000-0x0000000002F5C000-memory.dmp

Download

memory/2064-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2064-38-0x0000000007710000-0x00000000077B3000-memory.dmp

Download

memory/2924-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2924-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Download