2bc781fc7483d87492fc10c7e45d9098456724238a52b9eb0bc685225c1dbe4c

General

Target

4f54cfa24b92174065569c5730da549d.exe
Size

1000KB
MD5

4f54cfa24b92174065569c5730da549d
SHA1

c70f65a0b97c6a6bc342d8bb826e5bcdd351ff73
SHA256

2bc781fc7483d87492fc10c7e45d9098456724238a52b9eb0bc685225c1dbe4c
SHA512

b2d3922f597f13849c2fb72c9442190d19dd5638f86b1638190966f0aa360ba101b31a5fa018c85ba409a1afb970a0e1179aede6b8263da92fe160a3e19c43d6
SSDEEP

12288:Ot8dvr0hf8HYcj2Onf4nZ0vEXriBECaBwQ2tb5JLrnylUPqt0gHDS7eyod:OedKf8HYSREXd1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2740	4f54cfa24b92174065569c5730da549d.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	4f54cfa24b92174065569c5730da549d.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	4f54cfa24b92174065569c5730da549d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2740	4f54cfa24b92174065569c5730da549d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	4f54cfa24b92174065569c5730da549d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2960	4f54cfa24b92174065569c5730da549d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2960	4f54cfa24b92174065569c5730da549d.exe
2740	4f54cfa24b92174065569c5730da549d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2740	2960	4f54cfa24b92174065569c5730da549d.exe	28
PID 2960 wrote to memory of 2740	2960	4f54cfa24b92174065569c5730da549d.exe	28
PID 2960 wrote to memory of 2740	2960	4f54cfa24b92174065569c5730da549d.exe	28
PID 2960 wrote to memory of 2740	2960	4f54cfa24b92174065569c5730da549d.exe	28
PID 2740 wrote to memory of 2056	2740	4f54cfa24b92174065569c5730da549d.exe	29
PID 2740 wrote to memory of 2056	2740	4f54cfa24b92174065569c5730da549d.exe	29
PID 2740 wrote to memory of 2056	2740	4f54cfa24b92174065569c5730da549d.exe	29
PID 2740 wrote to memory of 2056	2740	4f54cfa24b92174065569c5730da549d.exe	29

C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe
"C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe
  C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe

Filesize
57KB

MD5
b878ee2e55dd62ccda0fe267bb76d3b5

SHA1
8128140a8193f5aef12d24a375dbbec82ff9a1b3

SHA256
01083e58b5eefe4217adc0759f419fc3cebe9c5cc400ab047c3781dcd1854382

SHA512
e036c59f8feb20accb16af217f9dc3b87b7cb5ad1d0cbe20bb671fc740a0afde5f1eba6a8de999f0f31074c7662f63d72f44b81bb7bed57c079599c31a53ee68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8603.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8645.tmp

Filesize
101KB

MD5
86671454b6ccbafc4886b5e051cf0154

SHA1
5775e4122a3f404a4f6958017410d41310e6799d

SHA256
6d5cace22b34844b2541a8570974856bb9afd1e2d2eef69bc7cd41783fe2f74c

SHA512
0235eb0a901c20380ed2d50d7f32cdbb9d6675c896acad6cff94d42dfc50231021dedfe88f77e4d090a4e62c232df8ecd0a396de9c1c9f43b54d4a80e9e2802a

Download Submit
\Users\Admin\AppData\Local\Temp\4f54cfa24b92174065569c5730da549d.exe

Filesize
188KB

MD5
2bf4106b1e30bfca29a641692e2e964f

SHA1
ad5029d06032a451def554f2db7639f4572dfc98

SHA256
a3ee6c9c2b1920deed1461c1a073d8b35bb02be78530bd8471fdc1675024fc82

SHA512
7f40b2fabdf9d887212ecbad011391d4c4a961bbd748323f46159b9e23ff49f6e8a5f2319327f19c5be8896151a34530ac71f7472367c8e9536e3284c27f03dd

Download Submit
memory/2740-17-0x0000000000280000-0x0000000000303000-memory.dmp

Filesize
524KB

Download
memory/2740-25-0x0000000002E50000-0x0000000002ECE000-memory.dmp

Filesize
504KB

Download
memory/2740-19-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2740-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2740-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2960-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2960-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2960-16-0x0000000003120000-0x00000000031A3000-memory.dmp

Filesize
524KB

Download
memory/2960-3-0x00000000001A0000-0x0000000000223000-memory.dmp

Filesize
524KB

Download
memory/2960-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads