97c0087da0bd9f31f135dadaf77e189d7c1bf640165f0d9f903a565dd12ce957

Analysis

max time kernel
111s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0dc74eb5909b6324e4451dd5ca5e9ce9.exe
Size

1000KB
MD5

0dc74eb5909b6324e4451dd5ca5e9ce9
SHA1

a5ceb667b5f22b29c9cf355f69c0f3f220d658fc
SHA256

97c0087da0bd9f31f135dadaf77e189d7c1bf640165f0d9f903a565dd12ce957
SHA512

349df40e33b5f80abeaf6f69748879817eb0441b3f3df992fcc965b1559659ca8eab789bcc8fd54d4ec8256cc5d9dae12ce86296efd38ffbf474a0ef1ea09f2a
SSDEEP

24576:AIHP60iLD0WjghOm8f1K1B+5vMiqt0gj2ed:THP65ffeOm8faqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Executes dropped EXE 1 IoCs

pid	Process
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3204	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3204	0dc74eb5909b6324e4451dd5ca5e9ce9.exe
4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4496	3204	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	19
PID 3204 wrote to memory of 4496	3204	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	19
PID 3204 wrote to memory of 4496	3204	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	19
PID 4496 wrote to memory of 4388	4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	22
PID 4496 wrote to memory of 4388	4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	22
PID 4496 wrote to memory of 4388	4496	0dc74eb5909b6324e4451dd5ca5e9ce9.exe	22

C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe
"C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe
  C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0dc74eb5909b6324e4451dd5ca5e9ce9.exe

Filesize
1KB

MD5
2d08be4553d0115fe4dab957cf1d4a35

SHA1
c63de22e0ac9cdb7e6be0c20f68ade733e271fc8

SHA256
4da81befc8831ce2c5c2e83be3c5915d0ee757b1f6b4d398d553d295f6a14f7b

SHA512
56def76f5441151616046e4e366942b538f66b1fa1019106c93fe8ed0995c4bb3a2924955964395bca22e5cf68c6bb3afb35d139b025acdc00878998691c1dce

Download Submit
memory/3204-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3204-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3204-1-0x0000000000150000-0x00000000001D3000-memory.dmp

Filesize
524KB

Download
memory/3204-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4496-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4496-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Filesize
504KB

Download
memory/4496-14-0x0000000001650000-0x00000000016D3000-memory.dmp

Filesize
524KB

Download
memory/4496-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download