988208f1bdf55940c24b7e09f0d4c2cc14c03b3bb4b8b2fe121a4f9ee615e3a6

General

Target

04c7c20c7108d55e4eb2e3145dfb93e5.exe
Size

506KB
MD5

04c7c20c7108d55e4eb2e3145dfb93e5
SHA1

f8edb3daad613a4688a3cf90e92a2543572d5b96
SHA256

988208f1bdf55940c24b7e09f0d4c2cc14c03b3bb4b8b2fe121a4f9ee615e3a6
SHA512

3f483bad33b890115dce7592f49d0df4361f2d68a8ad5b300cfdf068954dd0c32506f6ea9c8dd17b9ab078ba5498da28bc50d55f3c465784909eea40b9e779de
SSDEEP

12288:ylU9OgEsewHzYFvoYVIngS/RoRUHUBdDQNzuUQxrqxk0:b9uyzGAYVutHjyNYp

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Executes dropped EXE 1 IoCs

pid	Process
2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Loads dropped DLL 1 IoCs

pid	Process
2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe
2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2628	2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe	18
PID 2296 wrote to memory of 2628	2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe	18
PID 2296 wrote to memory of 2628	2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe	18
PID 2296 wrote to memory of 2628	2296	04c7c20c7108d55e4eb2e3145dfb93e5.exe	18
PID 2628 wrote to memory of 2644	2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe	20
PID 2628 wrote to memory of 2644	2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe	20
PID 2628 wrote to memory of 2644	2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe	20
PID 2628 wrote to memory of 2644	2628	04c7c20c7108d55e4eb2e3145dfb93e5.exe	20

C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe
"C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe
  C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe

Filesize
126KB

MD5
416ae2817e8685272fecb0f4affc6a8b

SHA1
df3fa187fc844632d2afad3b33369df4ba3a324c

SHA256
c40e02ea981a0995adbb2e8611df96419450f0f8ff305eaf332952f0d26ae84f

SHA512
ab3b7ea56907de1c719e445933ffa05ea037e0fa66d6b0e0a46aa202754ae874313384976b1acb3e67200bcb0afd98cf6a7eef71004313631b8c7e1f471dc944

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab39B8.tmp

Filesize
37KB

MD5
19ae298811f465dbd627de14144a0b1c

SHA1
4c27d9d8ef13ec10e3ba807148a8be6f67623355

SHA256
d34c55954ad038fd2dfa88e27662b0c99cb59be22d296c5910900b6020757d22

SHA512
fc0bdbf72901110557ad2abd967009bea93a351c4c6197a806f00a40d0b3e3cb170bf6637c6906d6328317775f32bf7ad613152ed25b1fded59eb8abce442d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39CB.tmp

Filesize
66KB

MD5
139feef2a218af11c827ce03d988160f

SHA1
7d657f8369ebd9248983bc1e75dfca5c4aa8944f

SHA256
66bddd6f996c39c3296942074d541eb65e450b723bcae0893634b91f433284d4

SHA512
524098d9afcc137e60788e0547ea52e1b3c959bdeea674cc8464013a16b8ad935fdf827dc24a61fc260565994cf209db00fe727eb5987103af1ae22dc63aeea1

Download Submit
\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe

Filesize
82KB

MD5
5e930dd00a68d39276554b9d94653cee

SHA1
73572490a353a5be79fe2a14f11428219b8dd965

SHA256
5191f42bce15a2d730556c5ca8e789d9c200dd410a13398317f7f90ce65c3458

SHA512
566d7fb4724cb05079e408e2b4a5805e9cc98efe330edca2cd855f6e09ecec2b79b6136d7dd06fed3c8f296036ad56dabc6e96577d077db5e87391bc8dea2215

Download Submit
memory/2296-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2296-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2296-17-0x0000000001520000-0x00000000015A3000-memory.dmp

Filesize
524KB

Download
memory/2296-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2296-3-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2628-20-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2628-22-0x0000000000260000-0x00000000002E3000-memory.dmp

Filesize
524KB

Download
memory/2628-29-0x00000000014F0000-0x000000000156E000-memory.dmp

Filesize
504KB

Download
memory/2628-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2628-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads