9fe57643fb90f5f1ca560a6a9861296d58290795f061f22b15dd19dcfeb882bc

Analysis

max time kernel
1s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2023 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

638d983d397e9ce408d91ae82b632106.exe
Size

640KB
MD5

638d983d397e9ce408d91ae82b632106
SHA1

477a1c06ff37abf3494373de86cfbf2d44d6bc1f
SHA256

9fe57643fb90f5f1ca560a6a9861296d58290795f061f22b15dd19dcfeb882bc
SHA512

04053481e52235cc3b6f2a21ccfd92ad9c448c80c9560ecd9ea03a0c9d771843e6830b03a0c9a2ec488a6855e0f13470f4beef3ef14608587850ecc92965e2c5
SSDEEP

12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4268 schtasks.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

638d983d397e9ce408d91ae82b632106.exe

pid process

2104 638d983d397e9ce408d91ae82b632106.exe

pid	process
4268	schtasks.exe

pid	process
2104	638d983d397e9ce408d91ae82b632106.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

638d983d397e9ce408d91ae82b632106.execmd.exe

description	pid	process	target process
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	cmd.exe
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	cmd.exe
PID 2104 wrote to memory of 2464	2104	638d983d397e9ce408d91ae82b632106.exe	cmd.exe
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe
PID 2104 wrote to memory of 1968	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe
PID 2464 wrote to memory of 4268	2464	cmd.exe	schtasks.exe
PID 2464 wrote to memory of 4268	2464	cmd.exe	schtasks.exe
PID 2464 wrote to memory of 4268	2464	cmd.exe	schtasks.exe
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe
PID 2104 wrote to memory of 2496	2104	638d983d397e9ce408d91ae82b632106.exe	638d983d397e9ce408d91ae82b632106.exe

C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
"C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
2⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1cf577b9dd994dc5b1fb65c6529fbb44.xml"
3⤵
- Creates scheduled task(s)
PID:4268

C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
"C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
2⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
"C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
2⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe
"C:\Users\Admin\AppData\Local\Temp\638d983d397e9ce408d91ae82b632106.exe"
3⤵
PID:2352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-133-0x0000000000000000-mapping.dmp

Download
memory/2104-136-0x0000000000D8A000-0x0000000000D90000-memory.dmp

Filesize
24KB

Download
memory/2352-137-0x0000000000000000-mapping.dmp

Download
memory/2464-132-0x0000000000000000-mapping.dmp

Download
memory/2496-135-0x0000000000000000-mapping.dmp

Download
memory/4268-134-0x0000000000000000-mapping.dmp

Download