64601e93c9c6e0de4ae75d66f93205c15e864ec88f9b87df08971de7dab57dc6

General

Target

154ed819c9ec968088d46708b9f1807c.exe
Size

506KB
MD5

154ed819c9ec968088d46708b9f1807c
SHA1

397cf34b893aab5d1a966dfb1c327cba25160a58
SHA256

64601e93c9c6e0de4ae75d66f93205c15e864ec88f9b87df08971de7dab57dc6
SHA512

0a1cba3b4aab903d81ac9364e15e82dd216a1be62122e694d3a076fcfa4a8a0f22ef711e281c2689fa2d8c06ce49b9cef5698d92f4265917c1600748516587f8
SSDEEP

12288:uxfqoEnnNfEvzoXF0rRjbq6OxtT0I97bDamrluHiiOqqMmkXqmQnIjxahAhaYeO1:usoEnXXybqJxR9bDauoiiOqqMmkXqmQ6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3056	154ed819c9ec968088d46708b9f1807c.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	154ed819c9ec968088d46708b9f1807c.exe

Loads dropped DLL 1 IoCs

pid	Process
3060	154ed819c9ec968088d46708b9f1807c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3056	154ed819c9ec968088d46708b9f1807c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	154ed819c9ec968088d46708b9f1807c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3060	154ed819c9ec968088d46708b9f1807c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3060	154ed819c9ec968088d46708b9f1807c.exe
3056	154ed819c9ec968088d46708b9f1807c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3056	3060	154ed819c9ec968088d46708b9f1807c.exe	28
PID 3060 wrote to memory of 3056	3060	154ed819c9ec968088d46708b9f1807c.exe	28
PID 3060 wrote to memory of 3056	3060	154ed819c9ec968088d46708b9f1807c.exe	28
PID 3060 wrote to memory of 3056	3060	154ed819c9ec968088d46708b9f1807c.exe	28
PID 3056 wrote to memory of 320	3056	154ed819c9ec968088d46708b9f1807c.exe	30
PID 3056 wrote to memory of 320	3056	154ed819c9ec968088d46708b9f1807c.exe	30
PID 3056 wrote to memory of 320	3056	154ed819c9ec968088d46708b9f1807c.exe	30
PID 3056 wrote to memory of 320	3056	154ed819c9ec968088d46708b9f1807c.exe	30

C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe
"C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe
  C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe

Filesize
382KB

MD5
329ff24871f94b99f902a32981308ea1

SHA1
8210ca40f1fee4343ff8668a00356ed4b2a8a6e8

SHA256
e7a8fc980562dfae305e57269d1c4fac818fdba852aa069a258a9c4d50f17c4e

SHA512
e108129b8775da1786eaf939b065356b81bcd1c6a0096e83e0aed8d22daf9de7fa9bd79dc4e78c6b0e193dd50f9cfe485d1229c5706dbb49c3613a5c0e39bda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A76.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\154ed819c9ec968088d46708b9f1807c.exe

Filesize
506KB

MD5
dd424f64c410a6efc38f636a4bcfe6d6

SHA1
efc61c38a71610c6c22f5bd9db54865240e668ea

SHA256
59e7e34d3a63e38144c3a989cccf04a5a9b49931544a14625c10c4bb4b7c6778

SHA512
1fd0638b2f0d025765ebaf6ee59bbf928ad80d4d2d73eafabce87a3d32291a8fa2846f30758c0638358edfa1cc90ab71c352904bcfdb2a9fdc345afc63a7df42

Download Submit
memory/3056-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3056-18-0x0000000000320000-0x00000000003A3000-memory.dmp

Filesize
524KB

Download
memory/3056-27-0x0000000002DA0000-0x0000000002E1E000-memory.dmp

Filesize
504KB

Download
memory/3056-21-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3056-67-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3060-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3060-15-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3060-12-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/3060-2-0x00000000001A0000-0x0000000000223000-memory.dmp

Filesize
524KB

Download
memory/3060-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads