cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe
Size

1.9MB
MD5

6ba590c0c63034288bb3f702577ae6d2
SHA1

365756b543bcf7ee6b3f6ebc0a02b39d07edefe8
SHA256

cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323
SHA512

dfd45d3cbb319cabe9a80a43b17852ee6d1a4fed2de70ae6abc77401ad4898519be571a832b5842ca5b59eb5b1266c59f128abe7654670a69dec86a7c51238aa
SSDEEP

49152:5LCGvtgtuuX2Z/foIHYwgPyeBhbq4TTow+lsgr5e:5LtQ8r4DyeBhhTW75

Score

9^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/2068-10-0x0000000000400000-0x00000000004A3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/memory/2068-39-0x000000000FD10000-0x000000000FDB3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Deletes itself 1 IoCs

pid	Process
2068	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2068	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2068	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2068	2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe	29
PID 2040 wrote to memory of 2068	2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe	29
PID 2040 wrote to memory of 2068	2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe	29
PID 2040 wrote to memory of 2068	2040	cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe	29

C:\Users\Admin\AppData\Local\Temp\cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe
"C:\Users\Admin\AppData\Local\Temp\cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe
  C:\Users\Admin\AppData\Local\Temp\cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cb8e853bdbc55ea5e46928eb75cab78152d6fd39641eba04d0af30c92c2e0323.exe

Filesize
1.9MB

MD5
042a868051a4f5e04434f15072154726

SHA1
158ddc1ec82cdc9b63d192b4074c0933b8b7a919

SHA256
3b77f5a3ce1d7617414aa3788728bf4e91f75fcdb9d9428a841a2325c3f24cf6

SHA512
582b20b41c173d5e71fda7fe0b19b13dff8a6b1b122e7a30248985c37ed34a6a3c994d92f2b13fd7e006e3b41b8872fa109f4d502d89336b892ff69b0825011b

Download Submit
memory/2040-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2040-6-0x0000000003110000-0x0000000003202000-memory.dmp

Filesize
968KB

Download
memory/2040-8-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2068-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2068-17-0x0000000002E60000-0x0000000002F52000-memory.dmp

Filesize
968KB

Download
memory/2068-16-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2068-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2068-39-0x000000000FD10000-0x000000000FDB3000-memory.dmp

Filesize
652KB

Download