baa3b869d2a37cfa7049c48ebe7eaafbcb723ecf9f831fafa1559f41dd21ffbf

Analysis

max time kernel
134s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18a77ac253bd6a684f5d6d8f546f274d.exe
Size

241KB
MD5

18a77ac253bd6a684f5d6d8f546f274d
SHA1

664079f287f1ef9dcf6955f8df7c5a4ebca19129
SHA256

baa3b869d2a37cfa7049c48ebe7eaafbcb723ecf9f831fafa1559f41dd21ffbf
SHA512

8a974fe79a0d648c2deda26b9d559dd43054969d35db52a6f36e7a007af568b3eac0093890ac3b4fe2932470e4e417bf87f9ae593908c2c0b3406d54ff78c41c
SSDEEP

6144:AmDVEIwn3qkNM7Y65dT/7Nxu07ywuwX4kaYkzs45+:AmDVEIca4M35dT/7NRewuwWsA+

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4368	18a77ac253bd6a684f5d6d8f546f274d.exe

Executes dropped EXE 1 IoCs

pid	Process
4368	18a77ac253bd6a684f5d6d8f546f274d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4368	18a77ac253bd6a684f5d6d8f546f274d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	18a77ac253bd6a684f5d6d8f546f274d.exe
4368	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2052	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2052	18a77ac253bd6a684f5d6d8f546f274d.exe
4368	18a77ac253bd6a684f5d6d8f546f274d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4368	2052	18a77ac253bd6a684f5d6d8f546f274d.exe	89
PID 2052 wrote to memory of 4368	2052	18a77ac253bd6a684f5d6d8f546f274d.exe	89
PID 2052 wrote to memory of 4368	2052	18a77ac253bd6a684f5d6d8f546f274d.exe	89
PID 4368 wrote to memory of 4496	4368	18a77ac253bd6a684f5d6d8f546f274d.exe	92
PID 4368 wrote to memory of 4496	4368	18a77ac253bd6a684f5d6d8f546f274d.exe	92
PID 4368 wrote to memory of 4496	4368	18a77ac253bd6a684f5d6d8f546f274d.exe	92

C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
"C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
  C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe

Filesize
1KB

MD5
ae71cdfac8fe80f7b66ea74f7576965f

SHA1
07aa7f330b21ec5fce0cb6e769a708bf1ac85f4b

SHA256
da9e16385481d1e9a25fce32e69d8d9314e4c4eb00af534b4b5ac4f29bef63d8

SHA512
649c5ea60aab44b9dbe276c384282808f86215877dee7a09c27e6666a536cf92dc5e0a0b921a66a77b744363673b1bcd3dc8dc329f3128b080ff5665b04ede72

Download Submit
memory/2052-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2052-1-0x0000000001670000-0x0000000001727000-memory.dmp

Filesize
732KB

Download
memory/2052-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2052-12-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4368-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4368-15-0x00000000014C0000-0x0000000001577000-memory.dmp

Filesize
732KB

Download
memory/4368-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4368-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4368-20-0x0000000001690000-0x00000000016F6000-memory.dmp

Filesize
408KB

Download