Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
37382ae0bbed2e7c641c66d793912286.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37382ae0bbed2e7c641c66d793912286.exe
Resource
win10v2004-20231215-en
General
-
Target
37382ae0bbed2e7c641c66d793912286.exe
-
Size
506KB
-
MD5
37382ae0bbed2e7c641c66d793912286
-
SHA1
062404b90e0b73a3fc94bc2e122db2c2e3df0d8e
-
SHA256
1a1368c2a7c93cc283431a8a0c4e48cd99afaa303fb8dab768c35d6e7154c036
-
SHA512
4b93445e2bda315347b8ced3bba4bdc6a284df5cdbd72c01e6948060d7cecd0f09b5066e0a830363f015c97fc1da4849243c178e8af84f150f9ff65e328eafc9
-
SSDEEP
12288:zZTqnZFH/XIkncUUZUoP7fzlXv+vivK99QHgKgzD3KTbHN0zmFfU0A1:zRyn6VhP75pvImHgKgzbKt0zmFfU/1
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1964 37382ae0bbed2e7c641c66d793912286.exe -
Executes dropped EXE 1 IoCs
pid Process 1964 37382ae0bbed2e7c641c66d793912286.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1964 37382ae0bbed2e7c641c66d793912286.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 37382ae0bbed2e7c641c66d793912286.exe 1964 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1840 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1840 37382ae0bbed2e7c641c66d793912286.exe 1964 37382ae0bbed2e7c641c66d793912286.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1964 1840 37382ae0bbed2e7c641c66d793912286.exe 18 PID 1840 wrote to memory of 1964 1840 37382ae0bbed2e7c641c66d793912286.exe 18 PID 1840 wrote to memory of 1964 1840 37382ae0bbed2e7c641c66d793912286.exe 18 PID 1964 wrote to memory of 3576 1964 37382ae0bbed2e7c641c66d793912286.exe 17 PID 1964 wrote to memory of 3576 1964 37382ae0bbed2e7c641c66d793912286.exe 17 PID 1964 wrote to memory of 3576 1964 37382ae0bbed2e7c641c66d793912286.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe"C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exeC:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1964
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\37382ae0bbed2e7c641c66d793912286.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:3576