d17fd1cde8dce6e2ab3e1131e21961d2e9759586b2678b386b7c259df35d75e9

Analysis

max time kernel
140s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bb666564410e31f11b5f3fcf232e509.exe
Size

506KB
MD5

1bb666564410e31f11b5f3fcf232e509
SHA1

89055b178b6009fe94f82d6ef2b1504c2e4ac9f0
SHA256

d17fd1cde8dce6e2ab3e1131e21961d2e9759586b2678b386b7c259df35d75e9
SHA512

98348cb7bbef21212a20442d2702bb27d9b330338be92a2c3c2bb1667d5dde18249ec76389f99bc5f9173387bcdd36ab80d7650314d2decee9b342557e806861
SSDEEP

6144:aTZAUsUEjwgafxU5a90BSZGh5sKU4WP7F0048Sbgf5s+RHNYYd7hM0oWc:aVPshjoZU5aoZhM7PSUxs+RHGudMBJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
224	1bb666564410e31f11b5f3fcf232e509.exe

Executes dropped EXE 1 IoCs

pid	Process
224	1bb666564410e31f11b5f3fcf232e509.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
224	1bb666564410e31f11b5f3fcf232e509.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	1bb666564410e31f11b5f3fcf232e509.exe
224	1bb666564410e31f11b5f3fcf232e509.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4128	1bb666564410e31f11b5f3fcf232e509.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4128	1bb666564410e31f11b5f3fcf232e509.exe
224	1bb666564410e31f11b5f3fcf232e509.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 224	4128	1bb666564410e31f11b5f3fcf232e509.exe	91
PID 4128 wrote to memory of 224	4128	1bb666564410e31f11b5f3fcf232e509.exe	91
PID 4128 wrote to memory of 224	4128	1bb666564410e31f11b5f3fcf232e509.exe	91
PID 224 wrote to memory of 2956	224	1bb666564410e31f11b5f3fcf232e509.exe	93
PID 224 wrote to memory of 2956	224	1bb666564410e31f11b5f3fcf232e509.exe	93
PID 224 wrote to memory of 2956	224	1bb666564410e31f11b5f3fcf232e509.exe	93

C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe
"C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe
  C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bb666564410e31f11b5f3fcf232e509.exe

Filesize
506KB

MD5
944c183a488aa5fbf55f4035026f4ae9

SHA1
455e151b688700c1b2b84960aeb4cc8ab779474e

SHA256
2d4c6b212b6fa023d78057e7f6a07e129d5035000cdedcfa2b076d0b0b09cc4c

SHA512
e7e5c5691e1fff6c44824d6ae06716ddd5069c31a58104a7af3e69f2be49e37a41737168d57e1f4de5ae18cce50977eb415f51b356039afe2920f96d493b2c83

Download Submit
memory/224-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/224-15-0x00000000015E0000-0x0000000001663000-memory.dmp

Filesize
524KB

Download
memory/224-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Filesize
504KB

Download
memory/224-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/224-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4128-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4128-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4128-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4128-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download