e1b6376d0a3efd319dbdf409aaa84860f0d40f423ba6a450616ed481319a327e

Analysis

max time kernel
90s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2023, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E1B6376D0A3EFD319DBDF409AAA84860F0D40F423BA6A.exe
Size 4.7MB
Sample230130-2ssywsdb38
SHA256 e1b6376d0a3efd319dbdf409aaa84860f0d40f423ba6a450616ed481319a327e
MD5 93428d178a9da1e8e6d5ab0d88fde69c
SHA1 ed553c7e89aba1da4fc14831d77b39dae1d6a103
SHA512 1aff838d9b5122c7f84825b179ad02a34ee5ab6292be1478d300584c7085d1458cf0c6f3a9d53a5fa4391ec0b400154f3e937bb6c30feeeb8672ee30f8941a14
SSDEEP 49152:MEtemKCr30qnrb/T4vO90d7HjmAFd4A64nsfJbRYZZGPzlWa5xXx5tFiBApv5E49:130qxiGrz5xEqPeQkTRQwy/IwZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	svcupdater.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4956	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	39	Go-http-client/1.1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1640	3036	E1B6376D0A3EFD319DBDF409AAA84860F0D40F423BA6A.exe	80
PID 3036 wrote to memory of 1640	3036	E1B6376D0A3EFD319DBDF409AAA84860F0D40F423BA6A.exe	80
PID 1640 wrote to memory of 4956	1640	cmd.exe	82
PID 1640 wrote to memory of 4956	1640	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\E1B6376D0A3EFD319DBDF409AAA84860F0D40F423BA6A.exe
"C:\Users\Admin\AppData\Local\Temp\E1B6376D0A3EFD319DBDF409AAA84860F0D40F423BA6A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\cmd.exe
  cmd.exe /C schtasks /create /tn ZUnmsjSLlI /tr C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn ZUnmsjSLlI /tr C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:4956

C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe
C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe
1⤵
- Executes dropped EXE
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe
Size 4.7MB
SHA256 e1b6376d0a3efd319dbdf409aaa84860f0d40f423ba6a450616ed481319a327e
MD5 93428d178a9da1e8e6d5ab0d88fde69c
SHA1 ed553c7e89aba1da4fc14831d77b39dae1d6a103
SHA512 1aff838d9b5122c7f84825b179ad02a34ee5ab6292be1478d300584c7085d1458cf0c6f3a9d53a5fa4391ec0b400154f3e937bb6c30feeeb8672ee30f8941a14
SSDEEP 49152:MEtemKCr30qnrb/T4vO90d7HjmAFd4A64nsfJbRYZZGPzlWa5xXx5tFiBApv5E49:130qxiGrz5xEqPeQkTRQwy/IwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\ZUnmsjSLlI\svcupdater.exe
Size 4.7MB
SHA256 e1b6376d0a3efd319dbdf409aaa84860f0d40f423ba6a450616ed481319a327e
MD5 93428d178a9da1e8e6d5ab0d88fde69c
SHA1 ed553c7e89aba1da4fc14831d77b39dae1d6a103
SHA512 1aff838d9b5122c7f84825b179ad02a34ee5ab6292be1478d300584c7085d1458cf0c6f3a9d53a5fa4391ec0b400154f3e937bb6c30feeeb8672ee30f8941a14
SSDEEP 49152:MEtemKCr30qnrb/T4vO90d7HjmAFd4A64nsfJbRYZZGPzlWa5xXx5tFiBApv5E49:130qxiGrz5xEqPeQkTRQwy/IwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads