80d20afca98b4cb59f66788a1d3b8b6850fbb4eea5755394de35fca08288750b

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

139f542d8e1cebeaa9c9c823751d29a1.exe
Size

506KB
MD5

139f542d8e1cebeaa9c9c823751d29a1
SHA1

ae2a966eba4a2a0cc33cd902c82e535e3109ff01
SHA256

80d20afca98b4cb59f66788a1d3b8b6850fbb4eea5755394de35fca08288750b
SHA512

4480895893e34b48d348584c150770720d2ab19e5e27df3e5e8f664d30d6d050ac06ed2e90da05f6bad56a5a4ebca51ac4d02e88e1a868dd50058c8b848826e6
SSDEEP

12288:9ZIvhoCPofm3yNEiQHxqh0jLajnJHOcd6D:b+ViEZHxm5LFr6D

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2252	139f542d8e1cebeaa9c9c823751d29a1.exe

Executes dropped EXE 1 IoCs

pid	Process
2252	139f542d8e1cebeaa9c9c823751d29a1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2252	139f542d8e1cebeaa9c9c823751d29a1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	139f542d8e1cebeaa9c9c823751d29a1.exe
2252	139f542d8e1cebeaa9c9c823751d29a1.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4380	139f542d8e1cebeaa9c9c823751d29a1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4380	139f542d8e1cebeaa9c9c823751d29a1.exe
2252	139f542d8e1cebeaa9c9c823751d29a1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2252	4380	139f542d8e1cebeaa9c9c823751d29a1.exe	15
PID 4380 wrote to memory of 2252	4380	139f542d8e1cebeaa9c9c823751d29a1.exe	15
PID 4380 wrote to memory of 2252	4380	139f542d8e1cebeaa9c9c823751d29a1.exe	15
PID 2252 wrote to memory of 3600	2252	139f542d8e1cebeaa9c9c823751d29a1.exe	19
PID 2252 wrote to memory of 3600	2252	139f542d8e1cebeaa9c9c823751d29a1.exe	19
PID 2252 wrote to memory of 3600	2252	139f542d8e1cebeaa9c9c823751d29a1.exe	19

C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe
"C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe
  C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\139f542d8e1cebeaa9c9c823751d29a1.exe

Filesize
227KB

MD5
abebdea73e3575fb9acf543edeff5e5a

SHA1
18809edd067eb7694d445fd605325dd27e589a34

SHA256
6d425a3417e4bf2127a69b2ab2253f5df87fab038410e604a3cd52142924df5f

SHA512
c51e4d57c448047040f406bd68da3b35e78b8d5fca378136282b0447265563f67c0159f82da094068b31fe32e4229ebcae85daeb1fd2bb4eb35a73689a526254

Download Submit
memory/2252-17-0x00000000016E0000-0x0000000001763000-memory.dmp

Filesize
524KB

Download
memory/2252-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2252-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/2252-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2252-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4380-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4380-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4380-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4380-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download