baa3b869d2a37cfa7049c48ebe7eaafbcb723ecf9f831fafa1559f41dd21ffbf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18a77ac253bd6a684f5d6d8f546f274d.exe
Size

241KB
MD5

18a77ac253bd6a684f5d6d8f546f274d
SHA1

664079f287f1ef9dcf6955f8df7c5a4ebca19129
SHA256

baa3b869d2a37cfa7049c48ebe7eaafbcb723ecf9f831fafa1559f41dd21ffbf
SHA512

8a974fe79a0d648c2deda26b9d559dd43054969d35db52a6f36e7a007af568b3eac0093890ac3b4fe2932470e4e417bf87f9ae593908c2c0b3406d54ff78c41c
SSDEEP

6144:AmDVEIwn3qkNM7Y65dT/7Nxu07ywuwX4kaYkzs45+:AmDVEIca4M35dT/7NRewuwWsA+

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2772	18a77ac253bd6a684f5d6d8f546f274d.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	18a77ac253bd6a684f5d6d8f546f274d.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	18a77ac253bd6a684f5d6d8f546f274d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2772	18a77ac253bd6a684f5d6d8f546f274d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2772	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2352	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2352	18a77ac253bd6a684f5d6d8f546f274d.exe
2772	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2772	2352	18a77ac253bd6a684f5d6d8f546f274d.exe	16
PID 2352 wrote to memory of 2772	2352	18a77ac253bd6a684f5d6d8f546f274d.exe	16
PID 2352 wrote to memory of 2772	2352	18a77ac253bd6a684f5d6d8f546f274d.exe	16
PID 2352 wrote to memory of 2772	2352	18a77ac253bd6a684f5d6d8f546f274d.exe	16
PID 2772 wrote to memory of 2544	2772	18a77ac253bd6a684f5d6d8f546f274d.exe	17
PID 2772 wrote to memory of 2544	2772	18a77ac253bd6a684f5d6d8f546f274d.exe	17
PID 2772 wrote to memory of 2544	2772	18a77ac253bd6a684f5d6d8f546f274d.exe	17
PID 2772 wrote to memory of 2544	2772	18a77ac253bd6a684f5d6d8f546f274d.exe	17

C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
"C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
  C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe

Filesize
20KB

MD5
8b3fe2306677751f846bfc5482946360

SHA1
34e78c601aba24731bec814998e6bcb2145d9427

SHA256
5836f51b08415fd65ea0f7279fd3afdd1b25db73c0d88970b17a3e8ac06d4c2b

SHA512
8310f4c37d3cba6b990979751ee032f323f3581fdd3e719652d46e1e7d3d87ec9f12e98506fc84888c07109eaafb073de162a5b7a49d14359c29b1f4dfcdae90

Download Submit
\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe

Filesize
54KB

MD5
55a6e4a1e5e2e1bd615730d9e29f7166

SHA1
1a5e1bd1ca9b2a86ccbdafb50be5b8b51e96c4e8

SHA256
6c9df7e44f8554c3bafb7bf57067168141ef9d4ca24042a758489ff9914aa9ac

SHA512
f095a05906f7e949bea0064b0e4fd01e21244dd097470185b2ccace484951e9a7a248f6ef5b1297bbe5e94751c88a0e866a0064510b5d5e8964cb5aab908461b

Download Submit
memory/2352-7-0x0000000000290000-0x0000000000347000-memory.dmp

Filesize
732KB

Download
memory/2352-15-0x0000000002E40000-0x0000000002EF7000-memory.dmp

Filesize
732KB

Download
memory/2352-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2352-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2352-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2772-18-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2772-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2772-29-0x0000000000350000-0x00000000003B6000-memory.dmp

Filesize
408KB

Download
memory/2772-20-0x0000000000230000-0x00000000002E7000-memory.dmp

Filesize
732KB

Download
memory/2772-17-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download