0dc162ada4d348db4275c78ecb2c34992085af386c7dc822f948753d0594f2f6

Analysis

max time kernel
151s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

508155abc50e69f13b5da20c5e7e10ec.exe
Size

1000KB
MD5

508155abc50e69f13b5da20c5e7e10ec
SHA1

309aa6fe80fbd9d0c6efb41e79ffc299cdb906d5
SHA256

0dc162ada4d348db4275c78ecb2c34992085af386c7dc822f948753d0594f2f6
SHA512

3eb3c646267fb1061f2f641dce7dba967514357c2d06888d0871d0094dee7f97fb557852365dc9b39fecb5a601231d4348528ee7b3df1cdbf719d96122922895
SSDEEP

12288:0+v/fE+lBgeWJ96ZY6Y6o/K2UDNECaBwQ2tb5JLrnylUPqt0gHDS7eyod:0A/seWJCY6yzUC1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4656	508155abc50e69f13b5da20c5e7e10ec.exe

Executes dropped EXE 1 IoCs

pid	Process
4656	508155abc50e69f13b5da20c5e7e10ec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4656	508155abc50e69f13b5da20c5e7e10ec.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	508155abc50e69f13b5da20c5e7e10ec.exe
4656	508155abc50e69f13b5da20c5e7e10ec.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2796	508155abc50e69f13b5da20c5e7e10ec.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2796	508155abc50e69f13b5da20c5e7e10ec.exe
4656	508155abc50e69f13b5da20c5e7e10ec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4656	2796	508155abc50e69f13b5da20c5e7e10ec.exe	94
PID 2796 wrote to memory of 4656	2796	508155abc50e69f13b5da20c5e7e10ec.exe	94
PID 2796 wrote to memory of 4656	2796	508155abc50e69f13b5da20c5e7e10ec.exe	94
PID 4656 wrote to memory of 1768	4656	508155abc50e69f13b5da20c5e7e10ec.exe	95
PID 4656 wrote to memory of 1768	4656	508155abc50e69f13b5da20c5e7e10ec.exe	95
PID 4656 wrote to memory of 1768	4656	508155abc50e69f13b5da20c5e7e10ec.exe	95

C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe
"C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe
  C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\508155abc50e69f13b5da20c5e7e10ec.exe

Filesize
1000KB

MD5
6fd1ab3ee7737fdda02832aa4c2f34b1

SHA1
164cd6a9376cdaf6b4b5951b41d92dc715cd0847

SHA256
59aae812d7c48496fb8b34e97c0574f33b812bdc4065c201d2cfcba2a4bede1b

SHA512
8e8c88dff02f709a316f921b52298206dff5f3273177fe76d6fede4dca697b3619a74ec3979c7a1efb08e89af26b72bbbbdf963a32927f3d28fd7ce2d7f90462

Download Submit
memory/2796-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2796-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2796-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2796-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4656-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4656-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4656-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Filesize
504KB

Download
memory/4656-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4656-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download