99e725cf4dd7b836d013e7e4c99b3c8b296f5d398406212a50664261b980d596

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

53b7e03aef49f8621007b7ac062b455c.exe
Size

535KB
MD5

53b7e03aef49f8621007b7ac062b455c
SHA1

0197c730fb2ed0c9322e17330adafbde60c01d4d
SHA256

99e725cf4dd7b836d013e7e4c99b3c8b296f5d398406212a50664261b980d596
SHA512

6613f9cf739d782af0d58ff0bf6d0bf8f9144cae9b6acb9d486b9824719e18c0035505efac5d07c6e98b6dce36f1c9cde1399784f7761721ed66ada470ea7365
SSDEEP

12288:aYHNdtX30ZxjEgUxwVNZ80ihqZdCVze9lqWOvabSw7VgJmQ:vHvkHH3Z8t8dYzOOy5Q

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1984	53b7e03aef49f8621007b7ac062b455c.exe

Executes dropped EXE 1 IoCs

pid	Process
1984	53b7e03aef49f8621007b7ac062b455c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1984	53b7e03aef49f8621007b7ac062b455c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	53b7e03aef49f8621007b7ac062b455c.exe
1984	53b7e03aef49f8621007b7ac062b455c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3320	53b7e03aef49f8621007b7ac062b455c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3320	53b7e03aef49f8621007b7ac062b455c.exe
1984	53b7e03aef49f8621007b7ac062b455c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 1984	3320	53b7e03aef49f8621007b7ac062b455c.exe	89
PID 3320 wrote to memory of 1984	3320	53b7e03aef49f8621007b7ac062b455c.exe	89
PID 3320 wrote to memory of 1984	3320	53b7e03aef49f8621007b7ac062b455c.exe	89
PID 1984 wrote to memory of 4276	1984	53b7e03aef49f8621007b7ac062b455c.exe	92
PID 1984 wrote to memory of 4276	1984	53b7e03aef49f8621007b7ac062b455c.exe	92
PID 1984 wrote to memory of 4276	1984	53b7e03aef49f8621007b7ac062b455c.exe	92

C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe
"C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe
  C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\53b7e03aef49f8621007b7ac062b455c.exe

Filesize
535KB

MD5
79e865533e520e4d316a771454c23dab

SHA1
cc6af758d7daa5f5806271def1a60e82df36dd61

SHA256
b79f1032549e572296c2fb80e46b6d79bee7a5b640f5c25e51733aeb209f4cb0

SHA512
86436e605f8da5cdea0906871abd027d133b2bb02b0e6ce5be015661125cfc2cdedeb3a1a36c3dee203a8af3a0e7d07f439d0f44c6b3a874c59fb5e07e01af1a

Download Submit
memory/1984-16-0x0000000001520000-0x00000000015C8000-memory.dmp

Filesize
672KB

Download
memory/1984-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1984-20-0x00000000016C0000-0x0000000001726000-memory.dmp

Filesize
408KB

Download
memory/1984-14-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3320-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3320-1-0x0000000001700000-0x00000000017A8000-memory.dmp

Filesize
672KB

Download
memory/3320-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3320-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download