Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09-01-2024 01:32
General
-
Target
4cfd237a6ffd85fb041b647d6f91371e.exe
-
Size
855KB
-
MD5
4cfd237a6ffd85fb041b647d6f91371e
-
SHA1
fabc1fc05e5f1cc3b64cd93c7e4da084693fb186
-
SHA256
f7d65ca5f001f1aa91cb78721000edfdad981d31128000d627240e9d14731b99
-
SHA512
f44853e18ea7ee0af8cf6cf7581a01f76618b68a49a1472da02e1d0f752afa48c30eb168ff9b878a9f65c798e3258f475840227ca1f54d6656efc9eb4596c3f2
-
SSDEEP
12288:lXueCFMXQ94t0sOzpf9rg6Q4wSkJd0+yTW+v80D3Fo2F8IECaBwQ2tb5JLrnylU6:lXuhOSsed9ESh+uRd7FocU1B+5vMiqx
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cfd237a6ffd85fb041b647d6f91371e.exe"C:\Users\Admin\AppData\Local\Temp\4cfd237a6ffd85fb041b647d6f91371e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4cfd237a6ffd85fb041b647d6f91371e.exeC:\Users\Admin\AppData\Local\Temp\4cfd237a6ffd85fb041b647d6f91371e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\4cfd237a6ffd85fb041b647d6f91371e.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD5241c940d761af6a3d1c708506b1f0aab
SHA17c0f4dfabf86c0b371e8410183f5ee827557887e
SHA2565f6f9881072e33441ae64dede60b3cd0972a8b6d227e744cf7986f090895c34d
SHA512f8ef963417ca2bfd894a49bce357ac6153863b0fb74bc3236cea6d9d5571e17c2e39b12dd24e341c9953f8b927299d1011a2d1d36f960ec23f6e29731e5a2169
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
20KB
MD53991165a62fab5af26e8868eedd4a1ee
SHA128467d86a2450f93aaa709a1f541be80b2cc5f27
SHA2562965711076b0f2a4c85976765cba9e6e8c2fb420fa484dc6e5c010db02f632ca
SHA5124d7e93e84f9fdfcc53fc345a3c91286c6432f87d261cdfe18b9cde0be31ceddc84cf1530760d151251198e947ff3735c9cd78129cce3c9e960ef304c4a6dfbbd
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
364KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
364KB