c980f372ebe4d629f292d2fcdf9e6bfeecc173cfb2cfa030f4053c62a142c391

Analysis

max time kernel
155s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

038ad1754386792e6688af384b5b70f4.exe
Size

1000KB
MD5

038ad1754386792e6688af384b5b70f4
SHA1

93956fd91a9f444d47aa5f6102c1b84897225638
SHA256

c980f372ebe4d629f292d2fcdf9e6bfeecc173cfb2cfa030f4053c62a142c391
SHA512

6c9ba7aaab729f6e4e87bf486a04f82f1eaa123992106dcca8bd09b780d92fab22b3a5a4e83b7320c7f29b6ba2597ede54152e1fd98deddc3f18b36851bd17e4
SSDEEP

12288:PDJtk8HIjYQWdreH3jc5hIYTkKstYMvL9PECaBwQ2tb5JLrnylUPqt0gHDS7eyod:rJ+aIthITkhtNM1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2888	038ad1754386792e6688af384b5b70f4.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	038ad1754386792e6688af384b5b70f4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2888	038ad1754386792e6688af384b5b70f4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	038ad1754386792e6688af384b5b70f4.exe
2888	038ad1754386792e6688af384b5b70f4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4640	038ad1754386792e6688af384b5b70f4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4640	038ad1754386792e6688af384b5b70f4.exe
2888	038ad1754386792e6688af384b5b70f4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2888	4640	038ad1754386792e6688af384b5b70f4.exe	91
PID 4640 wrote to memory of 2888	4640	038ad1754386792e6688af384b5b70f4.exe	91
PID 4640 wrote to memory of 2888	4640	038ad1754386792e6688af384b5b70f4.exe	91
PID 2888 wrote to memory of 772	2888	038ad1754386792e6688af384b5b70f4.exe	94
PID 2888 wrote to memory of 772	2888	038ad1754386792e6688af384b5b70f4.exe	94
PID 2888 wrote to memory of 772	2888	038ad1754386792e6688af384b5b70f4.exe	94

C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe
"C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe
  C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\038ad1754386792e6688af384b5b70f4.exe

Filesize
1000KB

MD5
6bd8911010fc132637d6440bbab108c4

SHA1
81f96d8b1e92849f57884fa9593b9bf468ad47b3

SHA256
89534b2ae037d5400097230e68a62c4737fc19f9807968b84316f2b17f0e3c65

SHA512
60f56451da882b82629ae828f2ee120b11463a86242772dc845a815428dab5a7808e23eb0aefb08bdfb03496fd040b4ff652c62d9b63eb2f198e48466ad79795

Download Submit
memory/2888-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2888-14-0x0000000001630000-0x00000000016B3000-memory.dmp

Filesize
524KB

Download
memory/2888-20-0x0000000004F80000-0x0000000004FFE000-memory.dmp

Filesize
504KB

Download
memory/2888-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2888-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4640-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4640-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/4640-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4640-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download