9fe57643fb90f5f1ca560a6a9861296d58290795f061f22b15dd19dcfeb882bc

Analysis

max time kernel
1s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2023 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

638d983d397e9ce408d91ae82b632106.exe
Size

640KB
MD5

638d983d397e9ce408d91ae82b632106
SHA1

477a1c06ff37abf3494373de86cfbf2d44d6bc1f
SHA256

9fe57643fb90f5f1ca560a6a9861296d58290795f061f22b15dd19dcfeb882bc
SHA512

04053481e52235cc3b6f2a21ccfd92ad9c448c80c9560ecd9ea03a0c9d771843e6830b03a0c9a2ec488a6855e0f13470f4beef3ef14608587850ecc92965e2c5
SSDEEP

12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4268	schtasks.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2104	638d983d397e9ce408d91ae82b632106.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	81
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	81
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	81
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	82
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	82
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	82
PID 2464 wrote to memory of 4268	2464	cmd.exe	84
PID 2464 wrote to memory of 4268	2464	cmd.exe	84
PID 2464 wrote to memory of 4268	2464	cmd.exe	84
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	83
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	83
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	83

C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
"C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
    3⤵
    - Creates scheduled task(s)
    PID:4268
- C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
  "C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
  "C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
  2⤵
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
    "C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
    3⤵
    PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-136-0x0000000000D8A000-0x0000000000D90000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads