b6159b677f18d99948695475482d56c7618c44cf7115840511323ac98a8cbbd4

General

Target

52e0809f33e55ab2c8763c971f7f5474.exe
Size

1000KB
MD5

52e0809f33e55ab2c8763c971f7f5474
SHA1

652d9c9412f998eee4e4652505fb7cb94487b3eb
SHA256

b6159b677f18d99948695475482d56c7618c44cf7115840511323ac98a8cbbd4
SHA512

fa461337d3e91ad431b2d0c0a7dc77b2a578ee72928c6dcaf1d989ef9f1d3a13ab475896c82e9290cd3f95ce0a4ac941a59d2a46894d539a44d676304a504573
SSDEEP

12288:EUMydh3X+wEZWgNLsbHLhdz1Ohc1EF/4ECaBwQ2tb5JLrnylUPqt0gHDS7eyod:EfAh3XNElNK3qiERr1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2668	52e0809f33e55ab2c8763c971f7f5474.exe

Executes dropped EXE 1 IoCs

pid	Process
2668	52e0809f33e55ab2c8763c971f7f5474.exe

Loads dropped DLL 1 IoCs

pid	Process
2388	52e0809f33e55ab2c8763c971f7f5474.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2668	52e0809f33e55ab2c8763c971f7f5474.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2668	52e0809f33e55ab2c8763c971f7f5474.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2388	52e0809f33e55ab2c8763c971f7f5474.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2388	52e0809f33e55ab2c8763c971f7f5474.exe
2668	52e0809f33e55ab2c8763c971f7f5474.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2668	2388	52e0809f33e55ab2c8763c971f7f5474.exe	28
PID 2388 wrote to memory of 2668	2388	52e0809f33e55ab2c8763c971f7f5474.exe	28
PID 2388 wrote to memory of 2668	2388	52e0809f33e55ab2c8763c971f7f5474.exe	28
PID 2388 wrote to memory of 2668	2388	52e0809f33e55ab2c8763c971f7f5474.exe	28
PID 2668 wrote to memory of 2808	2668	52e0809f33e55ab2c8763c971f7f5474.exe	29
PID 2668 wrote to memory of 2808	2668	52e0809f33e55ab2c8763c971f7f5474.exe	29
PID 2668 wrote to memory of 2808	2668	52e0809f33e55ab2c8763c971f7f5474.exe	29
PID 2668 wrote to memory of 2808	2668	52e0809f33e55ab2c8763c971f7f5474.exe	29

C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe
"C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe
  C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe

Filesize
623KB

MD5
5dd241f7fdd6bf85ce08b4dff4731f3b

SHA1
6f12d122d04845ac81be220f67a6ad475c84a679

SHA256
ded8ea5e55f41e56dd813aacb9a0da5d8304153313938fada684895abd944dbb

SHA512
27065ce89ea34a474c291ce3d9cdff06fb9251299564955ca104423e14b8f0bf7b9d5c7432e646810cbdb2b1d3ae86a964295c8712deb7d8ed059ddcd58779f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC332.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC373.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\52e0809f33e55ab2c8763c971f7f5474.exe

Filesize
770KB

MD5
302475f58763c9c105e807dbc84347a7

SHA1
110525475dae424fb97f26e7a6f6a6e6adbfd3a5

SHA256
5c1c25dfa73d12f3c9e959c7cb6553dd546fdc4172dde5d32681afd92b05866f

SHA512
a0b872076b4210dfba569f003a60a614c4f9ab47c816a7f1cef6a5b4c10c1d9233339b38902bfa0852737f02d6a919824f596bef3b268cf588eb7af93e3b7536

Download Submit
memory/2388-15-0x0000000001520000-0x00000000015A3000-memory.dmp

Filesize
524KB

Download
memory/2388-1-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2388-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2388-3-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2388-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2668-17-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2668-19-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/2668-25-0x0000000002E70000-0x0000000002EEE000-memory.dmp

Filesize
504KB

Download
memory/2668-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2668-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads