79125e6a91831b95ff0187d43dd6a882939f27c489df23639ac25539ce1034fd

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e02dc76c6e9acf3a32b16dd6c583c9.exe
Size

506KB
MD5

48e02dc76c6e9acf3a32b16dd6c583c9
SHA1

1c05a07ea19b8866d5a7a5a8a221bea11b71732e
SHA256

79125e6a91831b95ff0187d43dd6a882939f27c489df23639ac25539ce1034fd
SHA512

85b734c55dac1f190652247666031aee2fb08dc4d5ea6536604885ea4ba18ca4f1ec1ba77ce592cc6fd75aa81afdce02ee5c77ab0c9a942010a6c5b98c9ec6d3
SSDEEP

12288:97E2+ooN9nEW9Jxxj1nmRKaczOxtkpbm7NmttWhtyoi14r:97LAnEMjhmgacSQFcNmtctHNr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Executes dropped EXE 1 IoCs

pid	Process
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2440	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2440	48e02dc76c6e9acf3a32b16dd6c583c9.exe
948	48e02dc76c6e9acf3a32b16dd6c583c9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 948	2440	48e02dc76c6e9acf3a32b16dd6c583c9.exe	22
PID 2440 wrote to memory of 948	2440	48e02dc76c6e9acf3a32b16dd6c583c9.exe	22
PID 2440 wrote to memory of 948	2440	48e02dc76c6e9acf3a32b16dd6c583c9.exe	22
PID 948 wrote to memory of 1960	948	48e02dc76c6e9acf3a32b16dd6c583c9.exe	21
PID 948 wrote to memory of 1960	948	48e02dc76c6e9acf3a32b16dd6c583c9.exe	21
PID 948 wrote to memory of 1960	948	48e02dc76c6e9acf3a32b16dd6c583c9.exe	21

C:\Users\Admin\AppData\Local\Temp\48e02dc76c6e9acf3a32b16dd6c583c9.exe
"C:\Users\Admin\AppData\Local\Temp\48e02dc76c6e9acf3a32b16dd6c583c9.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\48e02dc76c6e9acf3a32b16dd6c583c9.exe
  C:\Users\Admin\AppData\Local\Temp\48e02dc76c6e9acf3a32b16dd6c583c9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:948

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\48e02dc76c6e9acf3a32b16dd6c583c9.exe" /TN Google_Trk_Updater /F
1⤵
- Creates scheduled task(s)
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/948-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/948-23-0x0000000004F10000-0x0000000004F8E000-memory.dmp

Filesize
504KB

Download
memory/948-16-0x0000000001680000-0x0000000001703000-memory.dmp

Filesize
524KB

Download
memory/948-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2440-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2440-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2440-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2440-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download