Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
37382ae0bbed2e7c641c66d793912286.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37382ae0bbed2e7c641c66d793912286.exe
Resource
win10v2004-20231215-en
General
-
Target
37382ae0bbed2e7c641c66d793912286.exe
-
Size
506KB
-
MD5
37382ae0bbed2e7c641c66d793912286
-
SHA1
062404b90e0b73a3fc94bc2e122db2c2e3df0d8e
-
SHA256
1a1368c2a7c93cc283431a8a0c4e48cd99afaa303fb8dab768c35d6e7154c036
-
SHA512
4b93445e2bda315347b8ced3bba4bdc6a284df5cdbd72c01e6948060d7cecd0f09b5066e0a830363f015c97fc1da4849243c178e8af84f150f9ff65e328eafc9
-
SSDEEP
12288:zZTqnZFH/XIkncUUZUoP7fzlXv+vivK99QHgKgzD3KTbHN0zmFfU0A1:zRyn6VhP75pvImHgKgzbKt0zmFfU/1
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2324 37382ae0bbed2e7c641c66d793912286.exe -
Executes dropped EXE 1 IoCs
pid Process 2324 37382ae0bbed2e7c641c66d793912286.exe -
Loads dropped DLL 1 IoCs
pid Process 1672 37382ae0bbed2e7c641c66d793912286.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2324 37382ae0bbed2e7c641c66d793912286.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2324 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1672 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1672 37382ae0bbed2e7c641c66d793912286.exe 2324 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2324 1672 37382ae0bbed2e7c641c66d793912286.exe 16 PID 1672 wrote to memory of 2324 1672 37382ae0bbed2e7c641c66d793912286.exe 16 PID 1672 wrote to memory of 2324 1672 37382ae0bbed2e7c641c66d793912286.exe 16 PID 1672 wrote to memory of 2324 1672 37382ae0bbed2e7c641c66d793912286.exe 16 PID 2324 wrote to memory of 2676 2324 37382ae0bbed2e7c641c66d793912286.exe 15 PID 2324 wrote to memory of 2676 2324 37382ae0bbed2e7c641c66d793912286.exe 15 PID 2324 wrote to memory of 2676 2324 37382ae0bbed2e7c641c66d793912286.exe 15 PID 2324 wrote to memory of 2676 2324 37382ae0bbed2e7c641c66d793912286.exe 15
Processes
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:2676
-
C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exeC:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2324
-
C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe"C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD5906b2ac447a2a162b8455659b81aff36
SHA10e4f0787c8a170f9de91985c27f62a7f352b43b4
SHA2563da65301c1fe3522b2ed97bbd0e2b74fa4a115f2d936dc19a96525b3017dc834
SHA512fc02361706fad5b8e93962e5edcc0c4cd8231da9c6e616c7fe4f934ec2a57bf822cf1f4daa621b988bef67cdad0e8d6dee03ee0699b57c94f8a4b028bb558f4f