d9c296e970bd193cc40f30b50efb8657fd16bb644e668b0195a0036c8ffbea55

Analysis

max time kernel
145s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

292d3ace60c6ca455b1dcaeb5ab5b10a.exe
Size

1000KB
MD5

292d3ace60c6ca455b1dcaeb5ab5b10a
SHA1

ad2f938ae89e3e92361cdb1b127533ce405da29c
SHA256

d9c296e970bd193cc40f30b50efb8657fd16bb644e668b0195a0036c8ffbea55
SHA512

e022a7f9c82bae2da5780aac10abed93d45a6e753a31bf84c88c7af39a435b319dca4f877d48c1a1a9cdb80ab1cd8739ec7b70f6a118d21e1f2d911b3b676e3c
SSDEEP

24576:2jJ7Pow2a5pZsfmtEpqIgorX8SofUwtFh0FzQi1B+5vMiqt0gj2ed:2jpowf5pZqmt0OorMS0Fh0xQoqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Executes dropped EXE 1 IoCs

pid	Process
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4940	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4940	292d3ace60c6ca455b1dcaeb5ab5b10a.exe
1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1100	4940	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	18
PID 4940 wrote to memory of 1100	4940	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	18
PID 4940 wrote to memory of 1100	4940	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	18
PID 1100 wrote to memory of 4320	1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	21
PID 1100 wrote to memory of 4320	1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	21
PID 1100 wrote to memory of 4320	1100	292d3ace60c6ca455b1dcaeb5ab5b10a.exe	21

C:\Users\Admin\AppData\Local\Temp\292d3ace60c6ca455b1dcaeb5ab5b10a.exe
"C:\Users\Admin\AppData\Local\Temp\292d3ace60c6ca455b1dcaeb5ab5b10a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\292d3ace60c6ca455b1dcaeb5ab5b10a.exe
  C:\Users\Admin\AppData\Local\Temp\292d3ace60c6ca455b1dcaeb5ab5b10a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\292d3ace60c6ca455b1dcaeb5ab5b10a.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1100-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Filesize
504KB

Download
memory/1100-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1100-15-0x0000000001610000-0x0000000001693000-memory.dmp

Filesize
524KB

Download
memory/1100-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4940-1-0x0000000001560000-0x00000000015E3000-memory.dmp

Filesize
524KB

Download
memory/4940-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4940-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4940-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download