830c7fb52e3b658c659f379eaab6b98303f43de57f6c51be9f517fba11ebd471

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1b4fcf585eed8bf8b6face17262abf.exe
Size

1000KB
MD5

3f1b4fcf585eed8bf8b6face17262abf
SHA1

f723b614c5de4f4d02abd71f0bba47489bf37211
SHA256

830c7fb52e3b658c659f379eaab6b98303f43de57f6c51be9f517fba11ebd471
SHA512

44959d5ccd342a0faf33831b8da8e096e685b9d015a3d67778f44096fcee3c8de1a2fadea38a6b579e98b06c27230fead2192d92e2a490f2712befb67a6978f1
SSDEEP

24576:JTgKlHhONl73vFuSj+aTCG1B+5vMiqt0gj2ed:JcDNtFQaTCkqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4768	3f1b4fcf585eed8bf8b6face17262abf.exe

Executes dropped EXE 1 IoCs

pid	Process
4768	3f1b4fcf585eed8bf8b6face17262abf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4768	3f1b4fcf585eed8bf8b6face17262abf.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	3f1b4fcf585eed8bf8b6face17262abf.exe
4768	3f1b4fcf585eed8bf8b6face17262abf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4704	3f1b4fcf585eed8bf8b6face17262abf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4704	3f1b4fcf585eed8bf8b6face17262abf.exe
4768	3f1b4fcf585eed8bf8b6face17262abf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4768	4704	3f1b4fcf585eed8bf8b6face17262abf.exe	88
PID 4704 wrote to memory of 4768	4704	3f1b4fcf585eed8bf8b6face17262abf.exe	88
PID 4704 wrote to memory of 4768	4704	3f1b4fcf585eed8bf8b6face17262abf.exe	88
PID 4768 wrote to memory of 2264	4768	3f1b4fcf585eed8bf8b6face17262abf.exe	91
PID 4768 wrote to memory of 2264	4768	3f1b4fcf585eed8bf8b6face17262abf.exe	91
PID 4768 wrote to memory of 2264	4768	3f1b4fcf585eed8bf8b6face17262abf.exe	91

C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe
"C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe
  C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3f1b4fcf585eed8bf8b6face17262abf.exe

Filesize
1000KB

MD5
6feff7100925c319ac976fc235eb8a52

SHA1
7b35fceae93b06d7b75c531b33982e742262a677

SHA256
a230718363f7dfa64dd097383e2429aceb66a85a93ef4b1717084a86b6e5b2eb

SHA512
5b0a734142461b51c11763db85bfdd629fd1d263380d09cf4ca6574fa7b097163092c3e097b93aa31a4f137999bebd116e22c18137e65b8abed3d5276c5063e3

Download Submit
memory/4704-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4704-1-0x0000000000170000-0x00000000001F3000-memory.dmp

Filesize
524KB

Download
memory/4704-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4704-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4768-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4768-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4768-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Filesize
504KB

Download
memory/4768-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4768-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download