ff480b7e9a7a676242d402f01233a5686fba2fe70f1ca16aeccb2ab6d052f10f

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74675d6d2d829154a7e78ddda56f3087.exe
Size 4.6MB
Sample221121-k17ctacd83
SHA256 ff480b7e9a7a676242d402f01233a5686fba2fe70f1ca16aeccb2ab6d052f10f
MD5 74675d6d2d829154a7e78ddda56f3087
SHA1 47f94b8a4c54a5562b9f215eff5cf78416ce8f58
SHA512 a055302ef03f501a83d66459fa71a4111fab8bd84e0247a4b57867e9d1b7d78bcebba2be83d2fb18a449cbe06d487e36f96204ef74129c692defc4d289995e0e
SSDEEP 49152:tB3p/I4yEFeJ0zS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKkpXsLV1eFI2RSQ/:bZQs323ZVWczxVCN/FSX+W81
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1156	TxGPlZuSrs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1904	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	57	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4008	1232	74675d6d2d829154a7e78ddda56f3087.exe	85
PID 1232 wrote to memory of 4008	1232	74675d6d2d829154a7e78ddda56f3087.exe	85
PID 1232 wrote to memory of 4008	1232	74675d6d2d829154a7e78ddda56f3087.exe	85
PID 4008 wrote to memory of 1904	4008	cmd.exe	87
PID 4008 wrote to memory of 1904	4008	cmd.exe	87
PID 4008 wrote to memory of 1904	4008	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\74675d6d2d829154a7e78ddda56f3087.exe
"C:\Users\Admin\AppData\Local\Temp\74675d6d2d829154a7e78ddda56f3087.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn phNyoXeSUq /tr C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn phNyoXeSUq /tr C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1904

C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe
C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe
1⤵
- Executes dropped EXE
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TxGPlZuSrs.exe

Path C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe
Size 390.0MB
SHA256 deef60305456da374c847d4555abafb2a39be239cf9546386c499c761a26db43
MD5 45c8f81bcc588fdc058ebd12b61c0a78
SHA1 3f7130f3e0bd3926a9455a25117e597e448e8349
SHA512 7cec4dfd819b92abd37409b2643ad0823c15ff47fe21f2e8b76a6f0df530d397084150bac963dbf1579a6245e9ecb81b66857cdcbfc7e4b4701ff710604ea32f
SSDEEP 12582912:jcjPK5MevVDPDMhNLq/rQUzxwRI0gf8FEig3F:jui57V7qNLq/MUzxA5jFEigV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TxGPlZuSrs.exe

Path C:\Users\Admin\AppData\Roaming\phNyoXeSUq\TxGPlZuSrs.exe
Size 390.0MB
SHA256 deef60305456da374c847d4555abafb2a39be239cf9546386c499c761a26db43
MD5 45c8f81bcc588fdc058ebd12b61c0a78
SHA1 3f7130f3e0bd3926a9455a25117e597e448e8349
SHA512 7cec4dfd819b92abd37409b2643ad0823c15ff47fe21f2e8b76a6f0df530d397084150bac963dbf1579a6245e9ecb81b66857cdcbfc7e4b4701ff710604ea32f
SSDEEP 12582912:jcjPK5MevVDPDMhNLq/rQUzxwRI0gf8FEig3F:jui57V7qNLq/MUzxA5jFEigV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads