fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8

Resubmissions

24/11/2022, 16:38

221124-t5ggmaah3y10

18/11/2022, 10:14

221118-l9yygada6s10

05/11/2022, 01:50

221105-b88feacgc88

Analysis

max time kernel
111s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svcupdater.exe
Size 4.8MB
Sample221105-b88feacgc8
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
756	svcupdater.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1432	schtasks.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	32	Go-http-client/1.1
HTTP User-Agent header	36	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1180	4932	svcupdater.exe	81
PID 4932 wrote to memory of 1180	4932	svcupdater.exe	81
PID 1180 wrote to memory of 1432	1180	cmd.exe	83
PID 1180 wrote to memory of 1432	1180	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\svcupdater.exe
"C:\Users\Admin\AppData\Local\Temp\svcupdater.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\cmd.exe
  cmd.exe "/C schtasks /create /tn \ipNnOYSRDI /tr \"C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \ipNnOYSRDI /tr \"C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
    3⤵
    - Creates scheduled task(s)
    PID:1432

C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe
C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe
1⤵
- Executes dropped EXE
PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads