9c06ae07276467701ef1ff03d888962e1c4bde82d43df10851c95cb42dc32066

Analysis

max time kernel
148s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2979238e6f297a39e164f17714ed6ec0.exe
Size

506KB
MD5

2979238e6f297a39e164f17714ed6ec0
SHA1

458c64595c57029f2a30b0bf2e9749368d8bec1e
SHA256

9c06ae07276467701ef1ff03d888962e1c4bde82d43df10851c95cb42dc32066
SHA512

11d3d4870586e24ef9a2c8d81f4e3fac607f1ec680eff18104f3ba190bf745f2fea9141c26af2a8acb2dafc106c76bc5dd31b97269944269a6ef192425afdf40
SSDEEP

12288:k/kaJvCOvQ69ev5/LsjZ17OfrGZARrNG6sYPoNrFW8VMRZ5Ida+djE6UMy:k/H5COvQDv5/LsjL6frGZARrhsQodFWT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
680	2979238e6f297a39e164f17714ed6ec0.exe

Executes dropped EXE 1 IoCs

pid	Process
680	2979238e6f297a39e164f17714ed6ec0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
680	2979238e6f297a39e164f17714ed6ec0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
680	2979238e6f297a39e164f17714ed6ec0.exe
680	2979238e6f297a39e164f17714ed6ec0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
768	2979238e6f297a39e164f17714ed6ec0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
768	2979238e6f297a39e164f17714ed6ec0.exe
680	2979238e6f297a39e164f17714ed6ec0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 680	768	2979238e6f297a39e164f17714ed6ec0.exe	93
PID 768 wrote to memory of 680	768	2979238e6f297a39e164f17714ed6ec0.exe	93
PID 768 wrote to memory of 680	768	2979238e6f297a39e164f17714ed6ec0.exe	93
PID 680 wrote to memory of 4064	680	2979238e6f297a39e164f17714ed6ec0.exe	94
PID 680 wrote to memory of 4064	680	2979238e6f297a39e164f17714ed6ec0.exe	94
PID 680 wrote to memory of 4064	680	2979238e6f297a39e164f17714ed6ec0.exe	94

C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe
"C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe
  C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2979238e6f297a39e164f17714ed6ec0.exe

Filesize
506KB

MD5
5cef91988ac3b266ae8b1fad65189ec5

SHA1
39c53a5eab3947439f143343e19ddf1cba5193d7

SHA256
a1a28bbe63b26c12196404cb5c6736b0a95c59f29b3fa837b645bc9e4cf4f8c1

SHA512
49fa6eddcc29560e388b5a23015dada6f294f2452dcac303fd831218bb0eb6e0f0db1e81f46c5e463d027ef04f21b8ddeefcdd6f4098c17ba234bdb3e105295c

Download Submit
memory/680-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/680-14-0x00000000016D0000-0x0000000001753000-memory.dmp

Filesize
524KB

Download
memory/680-20-0x0000000004FD0000-0x000000000504E000-memory.dmp

Filesize
504KB

Download
memory/680-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/680-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/768-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/768-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/768-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/768-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download