6cbfe1688619e7fa5833c1bd977600c773de5f645eb2cb18a6bdb687ce2d3aac

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

539c983312a60b5865cc5b99275eaed2.exe
Size

1000KB
MD5

539c983312a60b5865cc5b99275eaed2
SHA1

83d2ddf2e4ec091126b9a7b0853cf7fc50415281
SHA256

6cbfe1688619e7fa5833c1bd977600c773de5f645eb2cb18a6bdb687ce2d3aac
SHA512

55c79449a93dbfca8ddfe47d4e7d6a38e17d4b8e0dee453439e91d3a5d1e9e09e4ac3fe30a2b3e9f540e00c5dbed77c5a8ef65a958713ceae8f7a5308f615efa
SSDEEP

24576:XUqoRTWU5cksNjVWgHht1B+5vMiqt0gj2ed:foR66cksNjVZ/qOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1428	539c983312a60b5865cc5b99275eaed2.exe

Executes dropped EXE 1 IoCs

pid	Process
1428	539c983312a60b5865cc5b99275eaed2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1428	539c983312a60b5865cc5b99275eaed2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	539c983312a60b5865cc5b99275eaed2.exe
1428	539c983312a60b5865cc5b99275eaed2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4220	539c983312a60b5865cc5b99275eaed2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4220	539c983312a60b5865cc5b99275eaed2.exe
1428	539c983312a60b5865cc5b99275eaed2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1428	4220	539c983312a60b5865cc5b99275eaed2.exe	91
PID 4220 wrote to memory of 1428	4220	539c983312a60b5865cc5b99275eaed2.exe	91
PID 4220 wrote to memory of 1428	4220	539c983312a60b5865cc5b99275eaed2.exe	91
PID 1428 wrote to memory of 2364	1428	539c983312a60b5865cc5b99275eaed2.exe	92
PID 1428 wrote to memory of 2364	1428	539c983312a60b5865cc5b99275eaed2.exe	92
PID 1428 wrote to memory of 2364	1428	539c983312a60b5865cc5b99275eaed2.exe	92

C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe
"C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe
  C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\539c983312a60b5865cc5b99275eaed2.exe

Filesize
1000KB

MD5
e260dc5fbd604c6ef340a1a5edb48e51

SHA1
9dc57cb78f9428b1ec3d700f9ed4743695d132d1

SHA256
d6f1470752a053a6d29868df35fdd99f0e115e947588020333c3be3efaaa1fd0

SHA512
f4d6be804edf2ad552437507716e2eab0aa10c87d4799e24375ee23ee3b808946a65037d370b30f349f5d8701b2fe04ceec536e186df65e3a774c9e2fe145f28

Download Submit
memory/1428-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1428-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1428-20-0x0000000004F90000-0x000000000500E000-memory.dmp

Filesize
504KB

Download
memory/1428-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1428-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4220-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4220-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/4220-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4220-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download