f18804d2a0734609001e8dbc0f27e36d0a6fb26ed83b3d245556c89bb9e05cd8

Analysis

max time kernel
177s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bd9cbbdb891f25455676184a5675b14.exe
Size

506KB
MD5

5bd9cbbdb891f25455676184a5675b14
SHA1

c2b7f626885f5f759ec3efca09ba868a9b2ee21c
SHA256

f18804d2a0734609001e8dbc0f27e36d0a6fb26ed83b3d245556c89bb9e05cd8
SHA512

ecfd8329cb5429082f609898af3f4d8253dbccbd81bd127e5a864a360d1e073dcd78b3191b6f2bcb669011b82f8da9dfdbf9f9415ba474478c1220a2562f2e9f
SSDEEP

12288:Vns/UWKgVez+t3qabBcAwnbw8d+/M3aMZ8TEyakmkYM:VegMez+Vfcxnbfd+MvIzakmkx

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3096	5bd9cbbdb891f25455676184a5675b14.exe

Executes dropped EXE 1 IoCs

pid	Process
3096	5bd9cbbdb891f25455676184a5675b14.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3096	5bd9cbbdb891f25455676184a5675b14.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3096	5bd9cbbdb891f25455676184a5675b14.exe
3096	5bd9cbbdb891f25455676184a5675b14.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2896	5bd9cbbdb891f25455676184a5675b14.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2896	5bd9cbbdb891f25455676184a5675b14.exe
3096	5bd9cbbdb891f25455676184a5675b14.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3096	2896	5bd9cbbdb891f25455676184a5675b14.exe	91
PID 2896 wrote to memory of 3096	2896	5bd9cbbdb891f25455676184a5675b14.exe	91
PID 2896 wrote to memory of 3096	2896	5bd9cbbdb891f25455676184a5675b14.exe	91
PID 3096 wrote to memory of 1432	3096	5bd9cbbdb891f25455676184a5675b14.exe	95
PID 3096 wrote to memory of 1432	3096	5bd9cbbdb891f25455676184a5675b14.exe	95
PID 3096 wrote to memory of 1432	3096	5bd9cbbdb891f25455676184a5675b14.exe	95

C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe
"C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe
  C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5bd9cbbdb891f25455676184a5675b14.exe

Filesize
506KB

MD5
05090423c3feddf7694d123f016046b4

SHA1
0d49ae2af9335c6e0d2423d05473a5dc3ae41502

SHA256
edec98e01e5a8ff74578858ff994a709b094526e0a722dfe21db17443df1c5e4

SHA512
ede4a9d0e01408c2d4a2cb8617f894ff128cdfdf85683f740a7258458df8dc3fdfd1a970821bd4a374bc12308b83675a62689c125535c54aa88f038503d517c1

Download Submit
memory/2896-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2896-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2896-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2896-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3096-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3096-21-0x0000000004FC0000-0x000000000503E000-memory.dmp

Filesize
504KB

Download
memory/3096-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3096-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3096-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download