427ff654c456ea0356386304743dba93a0900af6e1a47cd09727e04378df96a1

Analysis

max time kernel
118s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1693bbca02310bcfb3fda0d31614cdc6.exe
Size

483KB
MD5

1693bbca02310bcfb3fda0d31614cdc6
SHA1

ba3a50df040b4362fe17ad4056ca11fb4a70cd90
SHA256

427ff654c456ea0356386304743dba93a0900af6e1a47cd09727e04378df96a1
SHA512

21d37c6aac1de93740cc7fd8c34cfcb76eecb15142c603071a7d75d4ef4c32dcc3d7bc7eadfe238d4458d8ebf4fd99457445e4ce419db944a54bda4233e4360a
SSDEEP

12288:Vz8FjK5I6ELIN8OyLjOrQ3tN5BLl/wxLPXn/9gmXuXs:V4FW5I6wQyjOrQ/5BOLvn/9gYuXs

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3976	1693bbca02310bcfb3fda0d31614cdc6.exe

Executes dropped EXE 1 IoCs

pid	Process
3976	1693bbca02310bcfb3fda0d31614cdc6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3976	1693bbca02310bcfb3fda0d31614cdc6.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	1693bbca02310bcfb3fda0d31614cdc6.exe
3976	1693bbca02310bcfb3fda0d31614cdc6.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3964	1693bbca02310bcfb3fda0d31614cdc6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3964	1693bbca02310bcfb3fda0d31614cdc6.exe
3976	1693bbca02310bcfb3fda0d31614cdc6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3976	3964	1693bbca02310bcfb3fda0d31614cdc6.exe	91
PID 3964 wrote to memory of 3976	3964	1693bbca02310bcfb3fda0d31614cdc6.exe	91
PID 3964 wrote to memory of 3976	3964	1693bbca02310bcfb3fda0d31614cdc6.exe	91
PID 3976 wrote to memory of 3512	3976	1693bbca02310bcfb3fda0d31614cdc6.exe	92
PID 3976 wrote to memory of 3512	3976	1693bbca02310bcfb3fda0d31614cdc6.exe	92
PID 3976 wrote to memory of 3512	3976	1693bbca02310bcfb3fda0d31614cdc6.exe	92

C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe
"C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe
  C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1693bbca02310bcfb3fda0d31614cdc6.exe

Filesize
483KB

MD5
3c0306fb7a8382b40d60103a80ebaaad

SHA1
76c884eeab5391a9ce6da4570fa124a245c3b0b5

SHA256
c7f1ffe120d3c786436753c0f710c6a067e6f69ed9aae0654211fc4c390aa123

SHA512
b7c72aea37fded8aa70676e60069df5f6449201075a324e801f730ac931458329f7ab3c58372fc229daa8c0d4c774365e5f90139777bfd1ff823522413171256

Download Submit
memory/3964-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3964-1-0x00000000014C0000-0x0000000001577000-memory.dmp

Filesize
732KB

Download
memory/3964-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3964-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3976-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3976-14-0x00000000016C0000-0x0000000001777000-memory.dmp

Filesize
732KB

Download
memory/3976-15-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3976-20-0x0000000004F20000-0x0000000004F86000-memory.dmp

Filesize
408KB

Download
memory/3976-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download