e609e57f0647b29f53009785a4af0dd7b2702327393f33ad9a03ae1a349d7fe6

General

Target

422da6ec9ebe7dbad56bcfbc78164e3d.exe
Size

506KB
MD5

422da6ec9ebe7dbad56bcfbc78164e3d
SHA1

d7d91c06e3dda19581e98a8c077c3d2e428d5898
SHA256

e609e57f0647b29f53009785a4af0dd7b2702327393f33ad9a03ae1a349d7fe6
SHA512

df76a8b4f50675ace03c2fe3a6e37c1c80e33342dee3868c55c7a0f0d6cf07626d64cc4dbae0b2f650e7ef7e6cf09a57bffcad8ad4e5faf5c02bcc72f6264e32
SSDEEP

12288:e0g9GqK4wU4Q4vjXSHByGSpGBczz3UTf3sds5gK9g/:e07dQms7j0z3UTfPH9g/

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Executes dropped EXE 1 IoCs

pid	Process
2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Loads dropped DLL 1 IoCs

pid	Process
2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe
2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2792	2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe	27
PID 2112 wrote to memory of 2792	2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe	27
PID 2112 wrote to memory of 2792	2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe	27
PID 2112 wrote to memory of 2792	2112	422da6ec9ebe7dbad56bcfbc78164e3d.exe	27
PID 2792 wrote to memory of 2660	2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe	28
PID 2792 wrote to memory of 2660	2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe	28
PID 2792 wrote to memory of 2660	2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe	28
PID 2792 wrote to memory of 2660	2792	422da6ec9ebe7dbad56bcfbc78164e3d.exe	28

C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe
"C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe
  C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe

Filesize
97KB

MD5
cd9ac67e0dbdab53e4b14587afa19edf

SHA1
28a0248f3bc10363ea03e8680f3af865c8fe427b

SHA256
b7f7c3e61aa0b1f07c13a7ee7580485f411a69074197432439700887c75cf96e

SHA512
f4bb2707d91e04f1e3e0f40ca34cdeeb457bcf52dc77da94e6accaef31a2346775a9617820686257796d59b9996a77b07e09f12d6571dab687912f8f545da215

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC0A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC4B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\422da6ec9ebe7dbad56bcfbc78164e3d.exe

Filesize
506KB

MD5
db0b7da2270762c818f9db9d25281050

SHA1
d34b8165b14d75dba57a81b381bcaf13ab8464fb

SHA256
ca3866e87a4b35732267a786ef9eea0df03573313c796f6c360046e4c55f2a02

SHA512
a0ef86c75087f004a3d128e55d754d18b52a3c5c8059ed2cab2424547ac992a2d6149d69f9236cb20b59473575fcd95ad7123ee276653cab4a35f70545f36cab

Download Submit
memory/2112-12-0x0000000002E50000-0x0000000002ED3000-memory.dmp

Filesize
524KB

Download
memory/2112-15-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2112-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2112-2-0x00000000001A0000-0x0000000000223000-memory.dmp

Filesize
524KB

Download
memory/2112-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2792-20-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2792-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2792-26-0x0000000001600000-0x000000000167E000-memory.dmp

Filesize
504KB

Download
memory/2792-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads