b3534c68469ad79aa34b7387a8929d943e367ae71cf7d1bbaf03930036489bd0

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576bc171e983cf3fe993db3237f0d5ef.exe
Size

1000KB
MD5

576bc171e983cf3fe993db3237f0d5ef
SHA1

a078451ba3bdd4f35146e436c73724e2c0a3b6bb
SHA256

b3534c68469ad79aa34b7387a8929d943e367ae71cf7d1bbaf03930036489bd0
SHA512

bc6c6977eaa22cfc7499f48a2c76006e66f0a012b4e99c15688b5411b51ba62fd72a14fa00b22b168897ab8caabf52d908ff02679187c89e9c8b24a4732bed13
SSDEEP

12288:+AIEnJsBjjzlgkbSOJqmTbMLQwiJHh3hu1JmZ9PK5wECaBwQ2tb5JLrnylUPqt0A:gH/JqmbMePMoPSD1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4892	576bc171e983cf3fe993db3237f0d5ef.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	576bc171e983cf3fe993db3237f0d5ef.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4892	576bc171e983cf3fe993db3237f0d5ef.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	576bc171e983cf3fe993db3237f0d5ef.exe
4892	576bc171e983cf3fe993db3237f0d5ef.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4588	576bc171e983cf3fe993db3237f0d5ef.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4588	576bc171e983cf3fe993db3237f0d5ef.exe
4892	576bc171e983cf3fe993db3237f0d5ef.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4892	4588	576bc171e983cf3fe993db3237f0d5ef.exe	88
PID 4588 wrote to memory of 4892	4588	576bc171e983cf3fe993db3237f0d5ef.exe	88
PID 4588 wrote to memory of 4892	4588	576bc171e983cf3fe993db3237f0d5ef.exe	88
PID 4892 wrote to memory of 3404	4892	576bc171e983cf3fe993db3237f0d5ef.exe	92
PID 4892 wrote to memory of 3404	4892	576bc171e983cf3fe993db3237f0d5ef.exe	92
PID 4892 wrote to memory of 3404	4892	576bc171e983cf3fe993db3237f0d5ef.exe	92

C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe
"C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe
  C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\576bc171e983cf3fe993db3237f0d5ef.exe

Filesize
1000KB

MD5
db45df91e9133cb516f383c0641aad7d

SHA1
f79eef096fae85a6a5f5cb1ca7d7ae62dcbacdc5

SHA256
09b7be887d9fd3b35cd797aa4c678a464c24f6df06d302d4b555435f5cb06c74

SHA512
55002023d5187919a0c954fc70c0ad33ac4c730287352396fb533c00a8e8e19d591057e9f7533d11d8b9d2be2fdfa75e5bec8e1b8c57d9ba3a128018ab3577f8

Download Submit
memory/4588-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4588-1-0x0000000001680000-0x0000000001703000-memory.dmp

Filesize
524KB

Download
memory/4588-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4588-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4892-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4892-14-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/4892-20-0x0000000004F30000-0x0000000004FAE000-memory.dmp

Filesize
504KB

Download
memory/4892-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4892-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download