558d8a2f1633831054c6d2afff811cf7478f0abf03aafaea2c8170ade07f589a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44c71adaf760ce0b29b533f723f59653.exe
Size

242KB
MD5

44c71adaf760ce0b29b533f723f59653
SHA1

37574242186b684cb828dc467d24af7cdedd73f6
SHA256

558d8a2f1633831054c6d2afff811cf7478f0abf03aafaea2c8170ade07f589a
SHA512

065088bef676615ef45548a10d50a35399d350792874d7d23380f720492e9981b7cb62f33124ec98320fffa631b640468b67d3fc04676df36a80c5aad881926d
SSDEEP

6144:6OH0Mw/90/gbIVdQqE6CtzAZMeVUDyr9AobcFCEsi4Wd:6xMauZQq2BAZdVUDyr9RIF7d

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1184	44c71adaf760ce0b29b533f723f59653.exe

Executes dropped EXE 1 IoCs

pid	Process
1184	44c71adaf760ce0b29b533f723f59653.exe

Loads dropped DLL 1 IoCs

pid	Process
2108	44c71adaf760ce0b29b533f723f59653.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1184	44c71adaf760ce0b29b533f723f59653.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1184	44c71adaf760ce0b29b533f723f59653.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2108	44c71adaf760ce0b29b533f723f59653.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2108	44c71adaf760ce0b29b533f723f59653.exe
1184	44c71adaf760ce0b29b533f723f59653.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1184	2108	44c71adaf760ce0b29b533f723f59653.exe	28
PID 2108 wrote to memory of 1184	2108	44c71adaf760ce0b29b533f723f59653.exe	28
PID 2108 wrote to memory of 1184	2108	44c71adaf760ce0b29b533f723f59653.exe	28
PID 2108 wrote to memory of 1184	2108	44c71adaf760ce0b29b533f723f59653.exe	28
PID 1184 wrote to memory of 2776	1184	44c71adaf760ce0b29b533f723f59653.exe	29
PID 1184 wrote to memory of 2776	1184	44c71adaf760ce0b29b533f723f59653.exe	29
PID 1184 wrote to memory of 2776	1184	44c71adaf760ce0b29b533f723f59653.exe	29
PID 1184 wrote to memory of 2776	1184	44c71adaf760ce0b29b533f723f59653.exe	29

C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe
"C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe
  C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44c71adaf760ce0b29b533f723f59653.exe

Filesize
242KB

MD5
f45e14dda77ea095f601d8ce178f2de2

SHA1
041a13e41544b38e1b2c6b780aaaf231d88ad191

SHA256
fe4dbc44adef92f9e27dc23c46d2b94bc6e6d7630ca79096543348996becf4b7

SHA512
0ea071d29dce9c29a7d8dac679264301e5ef996a19809d604af869ae6c1f1671ce36efd59cb89f6f5389d9766318eac7d975f0d01d9cc520e91afdada8696ef8

Download Submit
memory/1184-16-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1184-18-0x00000000014C0000-0x0000000001577000-memory.dmp

Filesize
732KB

Download
memory/1184-17-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1184-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1184-26-0x0000000001580000-0x00000000015E7000-memory.dmp

Filesize
412KB

Download
memory/2108-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2108-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2108-3-0x0000000000250000-0x0000000000307000-memory.dmp

Filesize
732KB

Download
memory/2108-14-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download