bcae6a5e4cdaa1a731ca5e5f6cd1105c07223800dda58153a25ef2a9bb4be8a8

Analysis

max time kernel
161s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ac1362a4fbc0662f9f772d5f20d73c8.exe
Size

506KB
MD5

3ac1362a4fbc0662f9f772d5f20d73c8
SHA1

dbc064e911bb1ec7df5f8b88a675a2d777edff1e
SHA256

bcae6a5e4cdaa1a731ca5e5f6cd1105c07223800dda58153a25ef2a9bb4be8a8
SHA512

f51b7603e99e7e3ecf7161c486d77d19cdbad4d2135c9ce6f98c180ff38415e56333aef3ff20216e7aec589fdb872629d36f52fa9f094063400915d7151de849
SSDEEP

12288:zvEaoNfAp4MJzgvMjfuj8XWyXeEvFS1SvCo:z8Yp4s9uj8GyXeiSVo

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Executes dropped EXE 1 IoCs

pid	Process
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2600	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2600	3ac1362a4fbc0662f9f772d5f20d73c8.exe
3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3980	2600	3ac1362a4fbc0662f9f772d5f20d73c8.exe	91
PID 2600 wrote to memory of 3980	2600	3ac1362a4fbc0662f9f772d5f20d73c8.exe	91
PID 2600 wrote to memory of 3980	2600	3ac1362a4fbc0662f9f772d5f20d73c8.exe	91
PID 3980 wrote to memory of 1376	3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe	92
PID 3980 wrote to memory of 1376	3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe	92
PID 3980 wrote to memory of 1376	3980	3ac1362a4fbc0662f9f772d5f20d73c8.exe	92

C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe
"C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe
  C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ac1362a4fbc0662f9f772d5f20d73c8.exe

Filesize
506KB

MD5
6b945efc75d0f0c1a0b3aa310938db96

SHA1
522c4946dd9ec4752b0053aed752be4ecd70d41c

SHA256
4161f557147894c235d639510cee727fcddfb956ca5ed49b6aa539ef59d2662d

SHA512
1dd8c935c0621ffe5621cc840af7a0b401ac5587cc82c24016a099abbc7e24fb35801e744f06b26f5a744f1a1a282f5c66be395d5db385f98cd18dd617a6d911

Download Submit
memory/2600-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2600-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2600-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3980-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3980-14-0x0000000001610000-0x0000000001693000-memory.dmp

Filesize
524KB

Download
memory/3980-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/3980-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3980-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download