2979aa50a257b11f87ea8fd30b38477f9e09bac4c2bcfc20de3d09351fa8b863

Analysis

max time kernel
15s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

108fcfcf9a40232ba24e0cda56e3baa0.exe
Size

1000KB
MD5

108fcfcf9a40232ba24e0cda56e3baa0
SHA1

92ce929081a101cf887249877cb8125e405d497b
SHA256

2979aa50a257b11f87ea8fd30b38477f9e09bac4c2bcfc20de3d09351fa8b863
SHA512

5ab00f074b0ebf1c8190323a1bde3cd2f716086852495494968f57e5e5f1b38ac070dc1f3bbb1f317f59dbeb7898d44918ed612cc5a09905ef423a9dac39a3d4
SSDEEP

12288:WxieZJSd7ioOKkNbmgZHx68nh1Y4g9ECaBwQ2tb5JLrnylUPqt0gHDS7eyod:aiugWoOJpZR6k/gW1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe

Executes dropped EXE 1 IoCs

pid	Process
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1772	108fcfcf9a40232ba24e0cda56e3baa0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1772	108fcfcf9a40232ba24e0cda56e3baa0.exe
4560	108fcfcf9a40232ba24e0cda56e3baa0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4560	1772	108fcfcf9a40232ba24e0cda56e3baa0.exe	20
PID 1772 wrote to memory of 4560	1772	108fcfcf9a40232ba24e0cda56e3baa0.exe	20
PID 1772 wrote to memory of 4560	1772	108fcfcf9a40232ba24e0cda56e3baa0.exe	20
PID 4560 wrote to memory of 2684	4560	108fcfcf9a40232ba24e0cda56e3baa0.exe	40
PID 4560 wrote to memory of 2684	4560	108fcfcf9a40232ba24e0cda56e3baa0.exe	40
PID 4560 wrote to memory of 2684	4560	108fcfcf9a40232ba24e0cda56e3baa0.exe	40

C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe
"C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe
  C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\108fcfcf9a40232ba24e0cda56e3baa0.exe

Filesize
7KB

MD5
a0da97814ad00c01f457eee0a385334f

SHA1
ec44640090315368d5f041529f59299f629a7010

SHA256
423c6c384ff1a36120cee3efbd9c20af986b715432972a3527f8be43528b2fa7

SHA512
a272cfbd03a27297545d99f535b61197d3418d3d8513247ff282f86f6388fe89b82bb4d0f0f59d3470781e14d5f5b9ce8dacd8c8726e98a77f653fd2c6224510

Download Submit
memory/1772-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1772-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1772-1-0x00000000015E0000-0x0000000001663000-memory.dmp

Filesize
524KB

Download
memory/1772-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4560-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4560-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4560-20-0x0000000001660000-0x00000000016DE000-memory.dmp

Filesize
504KB

Download
memory/4560-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4560-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download