45cd2af658c6581d46fce1b34f440c3f17ca71ba7098687da939e5320fbcb236

Analysis

max time kernel
137s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5647b380571385699eaa7eda35528dc3.exe
Size

506KB
MD5

5647b380571385699eaa7eda35528dc3
SHA1

250d42a7bd18aefe4e99f66267a0c07a40fe32aa
SHA256

45cd2af658c6581d46fce1b34f440c3f17ca71ba7098687da939e5320fbcb236
SHA512

b20e1348598bc69af5938411c9501e5e5ab8964a7696413a899417fc0601c51ad7e828f6aac42b84218ddf8927635fb1616050579e13e348c5a2b06afe5814f0
SSDEEP

12288:I/YdalDXwCRVKgsZr4JqBHPesOgXhZwaq4elvPv:b4lDXwCzK7Zr4kHWsOgxZwG6vn

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3004	5647b380571385699eaa7eda35528dc3.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	5647b380571385699eaa7eda35528dc3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3004	5647b380571385699eaa7eda35528dc3.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	5647b380571385699eaa7eda35528dc3.exe
3004	5647b380571385699eaa7eda35528dc3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4944	5647b380571385699eaa7eda35528dc3.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4944	5647b380571385699eaa7eda35528dc3.exe
3004	5647b380571385699eaa7eda35528dc3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3004	4944	5647b380571385699eaa7eda35528dc3.exe	17
PID 4944 wrote to memory of 3004	4944	5647b380571385699eaa7eda35528dc3.exe	17
PID 4944 wrote to memory of 3004	4944	5647b380571385699eaa7eda35528dc3.exe	17
PID 3004 wrote to memory of 3784	3004	5647b380571385699eaa7eda35528dc3.exe	42
PID 3004 wrote to memory of 3784	3004	5647b380571385699eaa7eda35528dc3.exe	42
PID 3004 wrote to memory of 3784	3004	5647b380571385699eaa7eda35528dc3.exe	42

C:\Users\Admin\AppData\Local\Temp\5647b380571385699eaa7eda35528dc3.exe
"C:\Users\Admin\AppData\Local\Temp\5647b380571385699eaa7eda35528dc3.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\5647b380571385699eaa7eda35528dc3.exe
  C:\Users\Admin\AppData\Local\Temp\5647b380571385699eaa7eda35528dc3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5647b380571385699eaa7eda35528dc3.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3784

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-61-0x000001B7D3310000-0x000001B7D3311000-memory.dmp

Filesize
4KB

Download
memory/2876-27-0x000001B7CAE70000-0x000001B7CAE80000-memory.dmp

Filesize
64KB

Download
memory/2876-43-0x000001B7CAF70000-0x000001B7CAF80000-memory.dmp

Filesize
64KB

Download
memory/2876-59-0x000001B7D32E0000-0x000001B7D32E1000-memory.dmp

Filesize
4KB

Download
memory/2876-62-0x000001B7D3310000-0x000001B7D3311000-memory.dmp

Filesize
4KB

Download
memory/2876-63-0x000001B7D3420000-0x000001B7D3421000-memory.dmp

Filesize
4KB

Download
memory/3004-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3004-26-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3004-19-0x0000000004FA0000-0x000000000501E000-memory.dmp

Filesize
504KB

Download
memory/3004-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4944-1-0x0000000000170000-0x00000000001F3000-memory.dmp

Filesize
524KB

Download
memory/4944-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4944-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4944-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download