32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
Size

1.9MB
MD5

030d58d0aff7a29efcbdc3febbfb3fd3
SHA1

f8dcc35da70fde2a08ef29222b0fed7f3f47c810
SHA256

32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6
SHA512

5153e247f1661476ea2a1d2f339873da61f244c10c20fa37c7ffe17d8df368e3f5cfa33a285909e2cc3dd7978ea595890668627f6b1cdf2d4e2f0c531eeaf78f
SSDEEP

49152:hltvubm454AdBubRZh3i7HgXgJbNsm+kwjI4TT86lorJ:hrvb4xButGFZshK4n86WrJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2512	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Executes dropped EXE 1 IoCs

pid	Process
2512	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Loads dropped DLL 1 IoCs

pid	Process
2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2512	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2512	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2512	2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe	29
PID 2324 wrote to memory of 2512	2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe	29
PID 2324 wrote to memory of 2512	2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe	29
PID 2324 wrote to memory of 2512	2324	32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe	29

C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
"C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
  C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe

Filesize
1.9MB

MD5
6878618a9fd8c1a486d38db03d1cf118

SHA1
321ce6478330b155c4004ea9c5f483810246f762

SHA256
c6947100050a3eeab62f21abc067a02593f84e957932b40defef8791928415f5

SHA512
122bbcf0e3f408a37007b301a4a353c6442287b937f874d0add75aa4c469dcf0301063c10f57e21f355b8ea4e7898665e783243e0acafc75d59f097a1ef3c687

Download Submit
memory/2324-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2324-7-0x0000000002ED0000-0x0000000002FE5000-memory.dmp

Filesize
1.1MB

Download
memory/2324-9-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2512-10-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2512-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2512-11-0x0000000001520000-0x0000000001635000-memory.dmp

Filesize
1.1MB

Download
memory/2512-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2512-39-0x000000000EF30000-0x000000000EFD3000-memory.dmp

Filesize
652KB

Download
memory/2512-40-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download