f92dbef334951720fc7e7a65904ffc4a57c8918484466889b700b1a3cd11125f

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WE5BMQP-NFDVBXLPQWF685283489.exe
Size

3.7MB
MD5

3bfa261ecd2452ffcb2c5b4f56cef4b8
SHA1

fe02268fd33c10a412fca4363028cc4e44ee33b3
SHA256

6d667f97393cc1b78483aa0b9d9dd7f11be0050583c863828bd3e6b93541c930
SHA512

77a5345ee6291132723bcd0381e26afde1ce857b4d11acb3ee27948941e67ae2c15148a6ac89ba195cdf8e9d4218cdfc32538e34c199bbfe903021c031c1e0e4
SSDEEP

49152:ALyffhimBZQDrcTvpSivSU0WQWH7FVEmP:ALyHgmLQvivSU0WQWH7FVEmP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	sites.google.com
32	sites.google.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\WE5BMQP-NFDVBXLPQWF685283489.exe
"C:\Users\Admin\AppData\Local\Temp\WE5BMQP-NFDVBXLPQWF685283489.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TempsOuXtFTMCL

Filesize
179KB

MD5
b8c02a951d8205d8e8a4b030b8a1a139

SHA1
d47d1128b7dbc7d4e34d5c991438683ecc0164bd

SHA256
89e35453d4e75c48b5cc84c0667764e70ba8a23e95866beefa662e43dd242df9

SHA512
3a4d9dac0c589116e717ecc297ea037951be6c84dd5fd28eb140bbbaece1c92e6a3d5a372e39b1d429523ae66577e4852a0498109da8ea8347481e8494ea5ae4

Download Submit
memory/3940-0-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3940-3-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3940-25-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download
memory/3940-26-0x0000000000400000-0x00000000007B7000-memory.dmp

Filesize
3.7MB

Download