4026f6557ab2fc5c600f5587e34e231259285fe2e6d4b85ea0aaa3558f854c73

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ee27e8dfdbe15e85177f4d0bdcf8467.exe
Size

1000KB
MD5

1ee27e8dfdbe15e85177f4d0bdcf8467
SHA1

1b60546ac6a011f5c6884379ce086eedbac66f30
SHA256

4026f6557ab2fc5c600f5587e34e231259285fe2e6d4b85ea0aaa3558f854c73
SHA512

0180b07d28dc13a50c64a4120b38c3c671ca83f4eeb9268ce0019fe45a685b2b02715be638096e858ba169914cde46f2252e8da1b638409e1b04f8c0e7165553
SSDEEP

24576:Qb+1SmoCxAC1dwzXEe1y1B+5vMiqt0gj2ed:Qb+1SmRwz0emqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Executes dropped EXE 1 IoCs

pid	Process
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3816	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3816	1ee27e8dfdbe15e85177f4d0bdcf8467.exe
3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3956	3816	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	17
PID 3816 wrote to memory of 3956	3816	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	17
PID 3816 wrote to memory of 3956	3816	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	17
PID 3956 wrote to memory of 4596	3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	61
PID 3956 wrote to memory of 4596	3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	61
PID 3956 wrote to memory of 4596	3956	1ee27e8dfdbe15e85177f4d0bdcf8467.exe	61

C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
"C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
  C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1ee27e8dfdbe15e85177f4d0bdcf8467.exe

Filesize
381KB

MD5
92e192e24ba6b441d5337a64461edfdb

SHA1
ef7cd7e0cf54eb07c07ad01d32d90b173d7cd633

SHA256
b73460de411120675d250633fbce09d091e219fe46f1287a81157c3ccc275e1f

SHA512
4b98338d9daabf1dd3d2564fc1e97a384e34e1514f18bfe310487918e0bb220710ec7e77bfe4ca448f0efc4a80a505cefaac870b99208f1642a0a471a96d1d1a

Download Submit
memory/3816-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3816-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3816-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/3816-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3956-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3956-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3956-20-0x0000000004FD0000-0x000000000504E000-memory.dmp

Filesize
504KB

Download
memory/3956-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3956-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download