Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
42f75da1f7cb04d1b9db57f8d3847c64.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42f75da1f7cb04d1b9db57f8d3847c64.exe
Resource
win10v2004-20231215-en
General
-
Target
42f75da1f7cb04d1b9db57f8d3847c64.exe
-
Size
506KB
-
MD5
42f75da1f7cb04d1b9db57f8d3847c64
-
SHA1
ce73b12fc5c71c748ef2644ab80627df93e06b16
-
SHA256
abed5b02d9b48738fdec421b06c1d1c13b773898e934cca03ec677be8c15fb0e
-
SHA512
0691cac62f188756e051bd7fde3a7073be57ab7f4e0a6a779055375fee26727e72d093f742a5fd659096a645cbfa9f1dce3f8ae3f19e052b057aeec1446fab8e
-
SSDEEP
12288:tgH/VghszAs7Wu/JKZqbfIX751bXCKqGfN81befZAsKBjlc8ksxfJ:tgfVmQAs7WusqbgV5XCKqGfN81biZgjv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 412 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Executes dropped EXE 1 IoCs
pid Process 412 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 412 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 412 42f75da1f7cb04d1b9db57f8d3847c64.exe 412 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2116 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2116 42f75da1f7cb04d1b9db57f8d3847c64.exe 412 42f75da1f7cb04d1b9db57f8d3847c64.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2116 wrote to memory of 412 2116 42f75da1f7cb04d1b9db57f8d3847c64.exe 20 PID 2116 wrote to memory of 412 2116 42f75da1f7cb04d1b9db57f8d3847c64.exe 20 PID 2116 wrote to memory of 412 2116 42f75da1f7cb04d1b9db57f8d3847c64.exe 20 PID 412 wrote to memory of 4844 412 42f75da1f7cb04d1b9db57f8d3847c64.exe 19 PID 412 wrote to memory of 4844 412 42f75da1f7cb04d1b9db57f8d3847c64.exe 19 PID 412 wrote to memory of 4844 412 42f75da1f7cb04d1b9db57f8d3847c64.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f75da1f7cb04d1b9db57f8d3847c64.exe"C:\Users\Admin\AppData\Local\Temp\42f75da1f7cb04d1b9db57f8d3847c64.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\42f75da1f7cb04d1b9db57f8d3847c64.exeC:\Users\Admin\AppData\Local\Temp\42f75da1f7cb04d1b9db57f8d3847c64.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\42f75da1f7cb04d1b9db57f8d3847c64.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:4844