6c4bfcef3dff8cb37c8fd96dc027a6df5b875e140b2b5f1f7b95764b7cae61c9

Analysis

max time kernel
74s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2022, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec12fa84505d150c516053a0d456de08.exe
Size 6.8MB
Sample220816-qdsh2accf3
SHA256 6c4bfcef3dff8cb37c8fd96dc027a6df5b875e140b2b5f1f7b95764b7cae61c9
MD5 ec12fa84505d150c516053a0d456de08
SHA1 5a6c718ae057e8927886c1d13d3643e5b9278e4d
SHA512 92785cae7e9b4017a751cb349ceb8401a38ca77d446b7a312157b3c3fa3243f37734bd649bf1c11303580cc292a21b6a5a278d0afd29274d80eea85cda97e6b3
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5104	ec12fa84505d150c516053a0d456de08.exe
5104	ec12fa84505d150c516053a0d456de08.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	ec12fa84505d150c516053a0d456de08.exe
5104	ec12fa84505d150c516053a0d456de08.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1340	5104	ec12fa84505d150c516053a0d456de08.exe	81
PID 5104 wrote to memory of 1340	5104	ec12fa84505d150c516053a0d456de08.exe	81
PID 5104 wrote to memory of 1340	5104	ec12fa84505d150c516053a0d456de08.exe	81
PID 5104 wrote to memory of 3192	5104	ec12fa84505d150c516053a0d456de08.exe	83
PID 5104 wrote to memory of 3192	5104	ec12fa84505d150c516053a0d456de08.exe	83
PID 5104 wrote to memory of 3192	5104	ec12fa84505d150c516053a0d456de08.exe	83

C:\Users\Admin\AppData\Local\Temp\ec12fa84505d150c516053a0d456de08.exe
"C:\Users\Admin\AppData\Local\Temp\ec12fa84505d150c516053a0d456de08.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Local Security Authority Process{K8G5D4S3V5F5D4-O63D4F5S6V-F7G8V3A2D4}" /tr "C:\Users\Admin\AppData\Roaming\Windows\System32\lsass.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1340
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Local Security Authority Process{K8G5D4S3V5F5D4-O63D4F5S6V-F7G8V3A2D4}"
  2⤵
  PID:3192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-132-0x0000000000BC0000-0x0000000001660000-memory.dmp

Download

memory/5104-133-0x0000000000BC0000-0x0000000001660000-memory.dmp

Download

memory/5104-136-0x0000000000BC0000-0x0000000001660000-memory.dmp

Download