Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 01:43
General
-
Target
23318ee513ee763b172019373de3c2a4.exe
-
Size
1000KB
-
MD5
23318ee513ee763b172019373de3c2a4
-
SHA1
33b77074a1ad21b8c9375b93109fb3f8c9a465c3
-
SHA256
c55d4295b071891bee370c26f0ace7f6bd5c3da340c57f65d80b35cc78d8a0fb
-
SHA512
f81db8c3cc39d1c7417b5c330953d51356fcca045445469eff561c79ddeec792bbb4600f1a96aec00b2b5bcb395823b4994a40c8fd9d7e6fdf6c98bcf96d7eb0
-
SSDEEP
24576:TZToIyhgyrCnLvUiAn4GW9mYGu2q0sq9F9rgzF71B+5vMiqt0gj2ed:TZTdyhgyrCnLvpAn4GW9mYGup0sq9F94
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23318ee513ee763b172019373de3c2a4.exe"C:\Users\Admin\AppData\Local\Temp\23318ee513ee763b172019373de3c2a4.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23318ee513ee763b172019373de3c2a4.exeC:\Users\Admin\AppData\Local\Temp\23318ee513ee763b172019373de3c2a4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\23318ee513ee763b172019373de3c2a4.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
930KB
MD5a6ce63fd5d685b035468bf22f684d53b
SHA1f9b84434e27bf9a5b67ea0a5ca91f1d29e219eb0
SHA25668766d40d47531282bf16a259c32eb7124b2eed228bc8920e866d6ab731d6230
SHA5127de5e67466fa2d1ebd8b370db000831ce1d7e569c954ac20645697d2b6e17b8c6cb2981f10aff676a95370dc27301974860045ca469410f84489d98b6c78aca6
-
Filesize
876KB
MD56aa1610b0d1a6350bfc7226b1c8e59b6
SHA175219b611c2349e7aa5ae658c0b45ee4bf80612d
SHA256e3af4845f53176fb24527076f455c2962d692baee14264bfe28135735e97b677
SHA51204183bab88a20764472d6f13caff3e25084baf80ca3f280cae002048d9b6713fef999a026c204a6c9de3488113e760139087ec37c879a621876ec14495734222
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
861KB
MD5d5c7716d403596f99e3f75d0f5cdceb3
SHA135b9a767ad4da6ef00fc978b052bf0bd5939cb4d
SHA25646c0c8a019aee29d4e64b796ce0b1ca85a1c79b6cd24c074d97e48ca21d71e7d
SHA51223b44d574518b1aed369c8108dd095f7a1e31c43a20114a45b72d5aac37d6e8323423a0544009116deea91ea2f80336ab170988b72b3ae26c4dc2ed60c50de4a
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB