4026f6557ab2fc5c600f5587e34e231259285fe2e6d4b85ea0aaa3558f854c73

Analysis

max time kernel
8s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ee27e8dfdbe15e85177f4d0bdcf8467.exe
Size

1000KB
MD5

1ee27e8dfdbe15e85177f4d0bdcf8467
SHA1

1b60546ac6a011f5c6884379ce086eedbac66f30
SHA256

4026f6557ab2fc5c600f5587e34e231259285fe2e6d4b85ea0aaa3558f854c73
SHA512

0180b07d28dc13a50c64a4120b38c3c671ca83f4eeb9268ce0019fe45a685b2b02715be638096e858ba169914cde46f2252e8da1b638409e1b04f8c0e7165553
SSDEEP

24576:Qb+1SmoCxAC1dwzXEe1y1B+5vMiqt0gj2ed:Qb+1SmRwz0emqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Executes dropped EXE 1 IoCs

pid	Process
2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Loads dropped DLL 1 IoCs

pid	Process
3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe
2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2252	3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	20
PID 3052 wrote to memory of 2252	3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	20
PID 3052 wrote to memory of 2252	3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	20
PID 3052 wrote to memory of 2252	3052	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	20
PID 2252 wrote to memory of 2752	2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	19
PID 2252 wrote to memory of 2752	2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	19
PID 2252 wrote to memory of 2752	2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	19
PID 2252 wrote to memory of 2752	2252	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	19

C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
"C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
  C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2252

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe" /TN Google_Trk_Updater /F
1⤵
- Creates scheduled task(s)
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Filesize
92KB

MD5
edcad39e562f42c35dd5aa49b8bcd42a

SHA1
8f438e04b5e54e03d8820d9c2246639865cdef1e

SHA256
2095f1d41ebcaee4d4bd6fcc8131e78ace237f865272917657d450e8e68e4e54

SHA512
3b60fecb9515394ac8290438f40896652f4938881303d3e6b624513678066092072f96c544dd8275048e67448afd7d54bef6cbd3ba98ca156e707656e8ce5afc

Download Submit
memory/2252-17-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2252-19-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2252-28-0x0000000002D30000-0x0000000002DAE000-memory.dmp

Filesize
504KB

Download
memory/2252-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2252-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3052-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3052-2-0x00000000001A0000-0x0000000000223000-memory.dmp

Filesize
524KB

Download
memory/3052-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3052-16-0x00000000030F0000-0x0000000003173000-memory.dmp

Filesize
524KB

Download
memory/3052-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download