43c27fd9e641162c67d14705cfda4e7dfe338b50749d9c0214c072889fe24a53

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c8f056fc8dad56d749af4a302df50c9.exe
Size

506KB
MD5

1c8f056fc8dad56d749af4a302df50c9
SHA1

042dd5122256ef2473a01912223dc60336f21151
SHA256

43c27fd9e641162c67d14705cfda4e7dfe338b50749d9c0214c072889fe24a53
SHA512

7bb8bda6656f9f0651b07543fae380785b2b60a57ebe90129a6319aeee67590102d2a9e50cfcdd41b4e297e87f9fe4870eb60c3eeae66a2408cb03e4939c65e0
SSDEEP

12288:bThAxgV9einaZf8B7OKeWIv1PL6QhaMMSQ3VuZdUOR:bTbQincgOKzM1mQh8VuZF

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	1c8f056fc8dad56d749af4a302df50c9.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	1c8f056fc8dad56d749af4a302df50c9.exe

Loads dropped DLL 1 IoCs

pid	Process
2672	1c8f056fc8dad56d749af4a302df50c9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2696	1c8f056fc8dad56d749af4a302df50c9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2672	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2672	1c8f056fc8dad56d749af4a302df50c9.exe
2696	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2696	2672	1c8f056fc8dad56d749af4a302df50c9.exe	28
PID 2672 wrote to memory of 2696	2672	1c8f056fc8dad56d749af4a302df50c9.exe	28
PID 2672 wrote to memory of 2696	2672	1c8f056fc8dad56d749af4a302df50c9.exe	28
PID 2672 wrote to memory of 2696	2672	1c8f056fc8dad56d749af4a302df50c9.exe	28
PID 2696 wrote to memory of 2692	2696	1c8f056fc8dad56d749af4a302df50c9.exe	30
PID 2696 wrote to memory of 2692	2696	1c8f056fc8dad56d749af4a302df50c9.exe	30
PID 2696 wrote to memory of 2692	2696	1c8f056fc8dad56d749af4a302df50c9.exe	30
PID 2696 wrote to memory of 2692	2696	1c8f056fc8dad56d749af4a302df50c9.exe	30

C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
"C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
  C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe

Filesize
506KB

MD5
f6564706043e50bbb73afbc5eebb7db7

SHA1
645e3695197a0e3433075a06c91dcca2f1298622

SHA256
428fcb4d1eb8d709a1aa967e4cf3eb0131cb33677c52d48b5e022a171dfd6098

SHA512
d5ee0827f50e8183c97145d9e844487e5d810359f7b4cd6da2d2fb8c2461f93d169ca10ca679eb0a3a9c04da9f13b75bbb898655dd1ed9618fe19e1b6d84f132

Download Submit
\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe

Filesize
256KB

MD5
995d9d6809dc4590d1ea9c216569e5e0

SHA1
6d95e792ff2ffd254097f29399db0603b81b6659

SHA256
8da337cbe3a1e618461924c0e97a5f5b576f7b4ea3a989831c6294bc094178e5

SHA512
8c2382e1c15c5a240b9a74397b4e022ecf9aa313116e8b478b97e153434190ef47f818f4ee2ce46d69d58dd6a2da62fd7c85097c5c36fc2b4eb903d4de0134de

Download Submit
memory/2672-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2672-1-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2672-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2672-15-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2672-12-0x0000000002F30000-0x0000000002FB3000-memory.dmp

Filesize
524KB

Download
memory/2696-18-0x00000000001A0000-0x0000000000223000-memory.dmp

Filesize
524KB

Download
memory/2696-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2696-25-0x0000000002DA0000-0x0000000002E1E000-memory.dmp

Filesize
504KB

Download
memory/2696-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download