0d940f08d64efc4b094727e8d8254542d6c1e87917628e1d48ea0bed86aa3247

General

Target

40c47bf171107772b25ebc2e4c93e07f.exe
Size

256KB
MD5

40c47bf171107772b25ebc2e4c93e07f
SHA1

3f359cee9149efd1c1f6c3af9b7a8fde00127649
SHA256

0d940f08d64efc4b094727e8d8254542d6c1e87917628e1d48ea0bed86aa3247
SHA512

946e6fb3bfb7e9b427d820a7a96f1e3bbbb23ccacc7e01c233d9feb8b5f690b00c55a701dab9c5a82e0e8bb346578b3eb9652d854eb8566856392ac44c3bf59e

Score

8^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

40c47bf171107772b25ebc2e4c93e07f.exechromegoogle.exe

description	pid	process	target process
PID 1388 set thread context of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1548 set thread context of 1948	1548	chromegoogle.exe	chromegoogle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

40c47bf171107772b25ebc2e4c93e07f.exechromegoogle.exe

description pid process

Token: SeDebugPrivilege 1816 40c47bf171107772b25ebc2e4c93e07f.exe
Token: SeDebugPrivilege 1948 chromegoogle.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

40c47bf171107772b25ebc2e4c93e07f.exe

pid process

1816 40c47bf171107772b25ebc2e4c93e07f.exe
1816 40c47bf171107772b25ebc2e4c93e07f.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1844 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

chromegoogle.exechromegoogle.exe

pid process

1548 chromegoogle.exe
1948 chromegoogle.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1584 timeout.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	pid	process
Token: SeDebugPrivilege	1816	40c47bf171107772b25ebc2e4c93e07f.exe
Token: SeDebugPrivilege	1948	chromegoogle.exe

pid	process
1816	40c47bf171107772b25ebc2e4c93e07f.exe
1816	40c47bf171107772b25ebc2e4c93e07f.exe

pid	process
1844	cmd.exe

pid	process
1548	chromegoogle.exe
1948	chromegoogle.exe

pid	process
1584	timeout.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

40c47bf171107772b25ebc2e4c93e07f.exe40c47bf171107772b25ebc2e4c93e07f.execmd.execmd.exechromegoogle.exe

description	pid	process	target process
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1388 wrote to memory of 1816	1388	40c47bf171107772b25ebc2e4c93e07f.exe	40c47bf171107772b25ebc2e4c93e07f.exe
PID 1816 wrote to memory of 1732	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1732	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1732	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1732	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1844	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1844	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1844	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1816 wrote to memory of 1844	1816	40c47bf171107772b25ebc2e4c93e07f.exe	cmd.exe
PID 1732 wrote to memory of 1624	1732	cmd.exe	schtasks.exe
PID 1732 wrote to memory of 1624	1732	cmd.exe	schtasks.exe
PID 1732 wrote to memory of 1624	1732	cmd.exe	schtasks.exe
PID 1732 wrote to memory of 1624	1732	cmd.exe	schtasks.exe
PID 1844 wrote to memory of 1584	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1584	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1584	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1584	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1548	1844	cmd.exe	chromegoogle.exe
PID 1844 wrote to memory of 1548	1844	cmd.exe	chromegoogle.exe
PID 1844 wrote to memory of 1548	1844	cmd.exe	chromegoogle.exe
PID 1844 wrote to memory of 1548	1844	cmd.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe
PID 1548 wrote to memory of 1948	1548	chromegoogle.exe	chromegoogle.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1624 schtasks.exe

pid	process
1624	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\40c47bf171107772b25ebc2e4c93e07f.exe
"C:\Users\Admin\AppData\Local\Temp\40c47bf171107772b25ebc2e4c93e07f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\40c47bf171107772b25ebc2e4c93e07f.exe
  "C:\Users\Admin\AppData\Local\Temp\40c47bf171107772b25ebc2e4c93e07f.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromegoogle" /tr '"C:\Users\Admin\AppData\Roaming\chromegoogle.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "chromegoogle" /tr '"C:\Users\Admin\AppData\Roaming\chromegoogle.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp146A.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1584
  - - C:\Users\Admin\AppData\Roaming\chromegoogle.exe
      "C:\Users\Admin\AppData\Roaming\chromegoogle.exe"
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Users\Admin\AppData\Roaming\chromegoogle.exe
        
        "C:\Users\Admin\AppData\Roaming\chromegoogle.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Executes dropped EXE
        
        PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp146A.tmp.bat

Download Submit
C:\Users\Admin\AppData\Roaming\chromegoogle.exe

Download Submit
C:\Users\Admin\AppData\Roaming\chromegoogle.exe

Download Submit
C:\Users\Admin\AppData\Roaming\chromegoogle.exe

Download Submit
\Users\Admin\AppData\Roaming\chromegoogle.exe

Download Submit
memory/1388-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1548-14-0x0000000000000000-mapping.dmp

Download
memory/1548-13-0x0000000000000000-mapping.dmp

Download
memory/1584-10-0x0000000000000000-mapping.dmp

Download
memory/1624-9-0x0000000000000000-mapping.dmp

Download
memory/1732-6-0x0000000000000000-mapping.dmp

Download
memory/1816-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1816-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1816-3-0x000000000040C78E-mapping.dmp

Download
memory/1816-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1844-7-0x0000000000000000-mapping.dmp

Download
memory/1948-19-0x000000000040C78E-mapping.dmp

Download
memory/1948-21-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1948-22-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads