43c27fd9e641162c67d14705cfda4e7dfe338b50749d9c0214c072889fe24a53

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c8f056fc8dad56d749af4a302df50c9.exe
Size

506KB
MD5

1c8f056fc8dad56d749af4a302df50c9
SHA1

042dd5122256ef2473a01912223dc60336f21151
SHA256

43c27fd9e641162c67d14705cfda4e7dfe338b50749d9c0214c072889fe24a53
SHA512

7bb8bda6656f9f0651b07543fae380785b2b60a57ebe90129a6319aeee67590102d2a9e50cfcdd41b4e297e87f9fe4870eb60c3eeae66a2408cb03e4939c65e0
SSDEEP

12288:bThAxgV9einaZf8B7OKeWIv1PL6QhaMMSQ3VuZdUOR:bTbQincgOKzM1mQh8VuZF

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1764	1c8f056fc8dad56d749af4a302df50c9.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	1c8f056fc8dad56d749af4a302df50c9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1764	1c8f056fc8dad56d749af4a302df50c9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	1c8f056fc8dad56d749af4a302df50c9.exe
1764	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3908	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3908	1c8f056fc8dad56d749af4a302df50c9.exe
1764	1c8f056fc8dad56d749af4a302df50c9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1764	3908	1c8f056fc8dad56d749af4a302df50c9.exe	20
PID 3908 wrote to memory of 1764	3908	1c8f056fc8dad56d749af4a302df50c9.exe	20
PID 3908 wrote to memory of 1764	3908	1c8f056fc8dad56d749af4a302df50c9.exe	20
PID 1764 wrote to memory of 3652	1764	1c8f056fc8dad56d749af4a302df50c9.exe	19
PID 1764 wrote to memory of 3652	1764	1c8f056fc8dad56d749af4a302df50c9.exe	19
PID 1764 wrote to memory of 3652	1764	1c8f056fc8dad56d749af4a302df50c9.exe	19

C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
"C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
  C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1764

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe" /TN Google_Trk_Updater /F
1⤵
- Creates scheduled task(s)
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c8f056fc8dad56d749af4a302df50c9.exe

Filesize
92KB

MD5
544c728cdd8388853fd3e6f7e1f4790c

SHA1
55b4adc566feb936dabe9273e3147bdc5ee89c6d

SHA256
75ab07ff63d35017beb67aa312af85c4af724f50584912ab4ec4b2d33cd466eb

SHA512
72f3a2b72fd5f8f4079415c9492bf678186beae9bf0392410b29a4c921e4694cc7814dfea8c0334b1e102ae83cee7064c2ccd6dba30ccc54224717208d4a0e27

Download Submit
memory/1764-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1764-16-0x0000000000160000-0x00000000001E3000-memory.dmp

Filesize
524KB

Download
memory/1764-21-0x0000000004F30000-0x0000000004FAE000-memory.dmp

Filesize
504KB

Download
memory/1764-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1764-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3908-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3908-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3908-1-0x0000000001610000-0x0000000001693000-memory.dmp

Filesize
524KB

Download
memory/3908-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download