da02136ee6059addaf02407fd2c7e9875910df8a1516985ae026909f7e4b6140

Analysis

max time kernel
141s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
Size 506KB
Sample231230-e6hzhsgbh6
SHA256 da02136ee6059addaf02407fd2c7e9875910df8a1516985ae026909f7e4b6140
MD5 0e96fc6ea1d9a0363a543ca2c9cc87bb
SHA1 246fba82d868623aff00f5d556fb8a06c994ae5a
SHA512 4f2d5a42b7004c732f91cba9487c5419af1a6e6b17e20d3402917e1f40ed4942c5f7e68e61194763faa85bdfcf340d78d9beecde0c2fa5eaac1d306ef6a01f30
SSDEEP 12288:ZiRQk+HhwXzryQrsyhCfSdl8vXZXAgKbW8qGwzt6KPBEZ6:QQf6NsyhCfoqXgqGjGBEI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Executes dropped EXE 1 IoCs

pid	Process
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3428	2428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	92
PID 2428 wrote to memory of 3428	2428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	92
PID 2428 wrote to memory of 3428	2428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	92
PID 3428 wrote to memory of 392	3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	93
PID 3428 wrote to memory of 392	3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	93
PID 3428 wrote to memory of 392	3428	0e96fc6ea1d9a0363a543ca2c9cc87bb.exe	93

C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
"C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
  C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e96fc6ea1d9a0363a543ca2c9cc87bb.exe

Path C:\Users\Admin\AppData\Local\Temp\0e96fc6ea1d9a0363a543ca2c9cc87bb.exe
Size 506KB
SHA256 a102c27227831d6e528b7aa76389c1c537ce2095b7f910d9e5f7385c4635745d
MD5 15c0fc2bcccb41c6b78463cf77cb465c
SHA1 c379d08682704affade8b48b5375745c2b394a78
SHA512 8288593432974c9cba4948548d766b5ea29c077ffc5d74e8aa545f1c0193b1f42add445d256d43f7e1b5a3db22f6788a2e5e316079514fca8198e6bf88c4756d
SSDEEP 6144:hbSW9BPlD2YLyVF5ldcjZUGMERRKwKjqpp8Pc/82RnEt9s0FmJnutYvvaWt46SBl:hbSeP0YL65luPiqXi1jZ3kas5Ep4aQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2428-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2428-1-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/2428-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2428-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3428-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/3428-14-0x00000000016E0000-0x0000000001763000-memory.dmp

Download

memory/3428-20-0x0000000004F10000-0x0000000004F8E000-memory.dmp

Download

memory/3428-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3428-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download