Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11-01-2024 12:22
General
-
Target
53814b3d1a2611c1586c942b16c7b361.exe
-
Size
506KB
-
MD5
53814b3d1a2611c1586c942b16c7b361
-
SHA1
2819c836d15b5ef3cc9798708adbad047992161d
-
SHA256
a631a17a51458f8dadaaac912513514d3988e1fee22a2a5a8820e8bbba4c100d
-
SHA512
516e479d4a9eaaca5cbead39e4092c40c9de85280322f63f46d3505bd3cebff98e9d7c03b100e0ae74a1792125fb303006d3c8e8fb0b1b393300e4b0ae91b248
-
SSDEEP
12288:IbVcoM5XAybv4Juw5Kd6YoOgNmgqnD3dk:6SD49KgYlmmbm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53814b3d1a2611c1586c942b16c7b361.exe"C:\Users\Admin\AppData\Local\Temp\53814b3d1a2611c1586c942b16c7b361.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53814b3d1a2611c1586c942b16c7b361.exeC:\Users\Admin\AppData\Local\Temp\53814b3d1a2611c1586c942b16c7b361.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\53814b3d1a2611c1586c942b16c7b361.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD531b556bc1dc72ef38209d3da2701fb76
SHA1fc64a86c6c30c081de8f2b2a36a32345be0413ea
SHA256a073f3fc8f389b9b21bac695c00b78a742463ca33e298fabfd7180c371c13cbe
SHA512ce4bcd1b2cf3c139f6fdf98cfac6fefa1268f7f4ffe8b6924368702f63cbe6c87411cbe392df398c9901748b9a6cb4f3ee54fa6400d441383883624f16a0af68
-
Filesize
434KB
MD5e09f7d42096d3fb26f27cd0cdef399cc
SHA10ddcdb250159b77fd363edf88bbd473889141bee
SHA256ab2db76d9966f5f511b664682eb3447257b8c7d111cf5277f12887f086bd1271
SHA512c331ec84a2ab594bb09d2d9633e81eb3051350f0882ebffc8905f7810e2792c42e4e30e0dfb8f5a71ae7a075e6ea82ff1e344f8f6fe373cabd4ea604ab7fa815
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
503KB
MD5fc3b2536ca3d51160fd84825cc72efd8
SHA1bb3a1bf1ebef14394d4b0c33be35f7faf867cf42
SHA256bca4d88d72c5329f4ce2ffd4d02fc4424444765010f5ec057de236215cd5632a
SHA51228e3d760e8385fba1dea057a0de29ad044776a2e9bedf55fae46789de4788d6cf525e4ccb0202fe70dd86f310c5f562d534c11c95e105c943fe112df43f08c64
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
364KB