5e2e1785a7e730427497e185e85d00bad9807e864ec3aa235c489470988186eb

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f033f2862105f8893f89d5b16476036.exe
Size

1000KB
MD5

3f033f2862105f8893f89d5b16476036
SHA1

0c9687d30172185331182f108819e61bd9d55de6
SHA256

5e2e1785a7e730427497e185e85d00bad9807e864ec3aa235c489470988186eb
SHA512

dd7766c5d6974089b086532a1d3e241e06e8a83336e41dddac56b12e419e88a75a1efac722bc91436791408fb3a016518076b836e282128764f88107f70fe3a7
SSDEEP

24576:EqfOgMUZVAjg1lVusez1B+5vMiqt0gj2ed:lfOi/ATqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4856	3f033f2862105f8893f89d5b16476036.exe

Executes dropped EXE 1 IoCs

pid	Process
4856	3f033f2862105f8893f89d5b16476036.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4856	3f033f2862105f8893f89d5b16476036.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	3f033f2862105f8893f89d5b16476036.exe
4856	3f033f2862105f8893f89d5b16476036.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2544	3f033f2862105f8893f89d5b16476036.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2544	3f033f2862105f8893f89d5b16476036.exe
4856	3f033f2862105f8893f89d5b16476036.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4856	2544	3f033f2862105f8893f89d5b16476036.exe	20
PID 2544 wrote to memory of 4856	2544	3f033f2862105f8893f89d5b16476036.exe	20
PID 2544 wrote to memory of 4856	2544	3f033f2862105f8893f89d5b16476036.exe	20
PID 4856 wrote to memory of 2844	4856	3f033f2862105f8893f89d5b16476036.exe	24
PID 4856 wrote to memory of 2844	4856	3f033f2862105f8893f89d5b16476036.exe	24
PID 4856 wrote to memory of 2844	4856	3f033f2862105f8893f89d5b16476036.exe	24

C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe
"C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe
  C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3f033f2862105f8893f89d5b16476036.exe

Filesize
92KB

MD5
f38e1b24ed64bf4f4057604c16e89c31

SHA1
d6a1084cb195bb944e180f9ecd4720aa7d353ff5

SHA256
55385b92d81a77d77d6d659b9f0aadc19c1bb7ffac886cba92b191cbaef1a933

SHA512
c118826cd600d43e1ae964a5bd1080cd8a0d72cc8a2feb975939eaf0cb399180f5fa5b808fcf53a5a81983219850c3c674e73e36328c214d76194b0ec18fc0ab

Download Submit
memory/2544-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2544-1-0x0000000001640000-0x00000000016C3000-memory.dmp

Filesize
524KB

Download
memory/2544-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2544-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4856-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4856-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4856-21-0x0000000004F30000-0x0000000004FAE000-memory.dmp

Filesize
504KB

Download
memory/4856-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4856-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download