d33f7ad6c94bb844c45336c23e7e92b4fac53a371c4b1417974bbe4e59b828fb

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

370d97a34a0a1fc909d54a2a02e98053.exe
Size

1000KB
MD5

370d97a34a0a1fc909d54a2a02e98053
SHA1

7f19d950d9bd022bb722527de0ccf512e6078e9c
SHA256

d33f7ad6c94bb844c45336c23e7e92b4fac53a371c4b1417974bbe4e59b828fb
SHA512

c7b73e64ba5006116832b5ab121e49fb10b268794f81318a9edc8eedb09f61c52cfb696bcf8729d99d158e17a9629a583fc9839f16047ca64e929c34289f1835
SSDEEP

12288:2r7sSyOJe2bN5esyOmnQHpqb+zZQWuWkUMhfECaBwQ2tb5JLrnylUPqt0gHDS7ed:07sCJe2paOVgbWjLr1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2564	370d97a34a0a1fc909d54a2a02e98053.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	370d97a34a0a1fc909d54a2a02e98053.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2564	370d97a34a0a1fc909d54a2a02e98053.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	370d97a34a0a1fc909d54a2a02e98053.exe
2564	370d97a34a0a1fc909d54a2a02e98053.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3480	370d97a34a0a1fc909d54a2a02e98053.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3480	370d97a34a0a1fc909d54a2a02e98053.exe
2564	370d97a34a0a1fc909d54a2a02e98053.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2564	3480	370d97a34a0a1fc909d54a2a02e98053.exe	90
PID 3480 wrote to memory of 2564	3480	370d97a34a0a1fc909d54a2a02e98053.exe	90
PID 3480 wrote to memory of 2564	3480	370d97a34a0a1fc909d54a2a02e98053.exe	90
PID 2564 wrote to memory of 2008	2564	370d97a34a0a1fc909d54a2a02e98053.exe	94
PID 2564 wrote to memory of 2008	2564	370d97a34a0a1fc909d54a2a02e98053.exe	94
PID 2564 wrote to memory of 2008	2564	370d97a34a0a1fc909d54a2a02e98053.exe	94

C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe
"C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe
  C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\370d97a34a0a1fc909d54a2a02e98053.exe

Filesize
33KB

MD5
c13209689e0664e6bcbab088ab3ac3a0

SHA1
a978a8ca83e6984cd821b9eddf3e57fd7941dcb8

SHA256
8cf85c7bd6c6f47f9ac7d99bcadc4f9d153691a89dc2240bd6086a7893f6544f

SHA512
73d928b58a47ba9a3ff147494335265fe224d478c83c43f0de976d1fb032ebef570d5536192d55f881c733476a1456435c0f01859f9c1cacf104b4d1fc55bc7e

Download Submit
memory/2564-20-0x0000000004F10000-0x0000000004F8E000-memory.dmp

Filesize
504KB

Download
memory/2564-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2564-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2564-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3480-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3480-1-0x00000000016B0000-0x0000000001733000-memory.dmp

Filesize
524KB

Download
memory/3480-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3480-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download