fae9ba267b2913d32e0a65e4d36faa086f5ec19ef87dfd77d7c4ecc756a2c812

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5734ffbafde3b8c0490a1ef0539a9c73.exe
Size

506KB
MD5

5734ffbafde3b8c0490a1ef0539a9c73
SHA1

ee45c77fb35baa09d24b5b03a4c1703643f8af3c
SHA256

fae9ba267b2913d32e0a65e4d36faa086f5ec19ef87dfd77d7c4ecc756a2c812
SHA512

767c3d1bc787ac78d99ddf23cf67fb46be08610a545e95dd0b17454d00629c4891fea248c82babf4f439794272a51d418ae128d12091cca8dc9b74c5630e8069
SSDEEP

6144:kOLpbRqL6BMUiEOCuS0SV1jF98ovfOrKkbmzHhNpI1ThRTpcyeqmNLHvJJAqETyW:kEN33AJ4jFZlHU9AbjhEOW

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe

Executes dropped EXE 1 IoCs

pid	Process
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1312	5734ffbafde3b8c0490a1ef0539a9c73.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1312	5734ffbafde3b8c0490a1ef0539a9c73.exe
1668	5734ffbafde3b8c0490a1ef0539a9c73.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1668	1312	5734ffbafde3b8c0490a1ef0539a9c73.exe	88
PID 1312 wrote to memory of 1668	1312	5734ffbafde3b8c0490a1ef0539a9c73.exe	88
PID 1312 wrote to memory of 1668	1312	5734ffbafde3b8c0490a1ef0539a9c73.exe	88
PID 1668 wrote to memory of 1352	1668	5734ffbafde3b8c0490a1ef0539a9c73.exe	92
PID 1668 wrote to memory of 1352	1668	5734ffbafde3b8c0490a1ef0539a9c73.exe	92
PID 1668 wrote to memory of 1352	1668	5734ffbafde3b8c0490a1ef0539a9c73.exe	92

C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe
"C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe
  C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe

Filesize
506KB

MD5
44a33e1b9557f0a7b68a6c6cd98d806b

SHA1
f61a38337284a01575193b7fb9f75872dfae3a56

SHA256
0002f13aaea16e0033fe9ed0483276f442c975f9de6c73ca88115ced89e3509d

SHA512
18f8dca170aef47072cdad834a239a25fba365856953ba5a5ac685e9196b1b8ef5b9115264d2b17b776b3b12915695e5f0049ac19bb7f72f4e09efdd50f607bc

Download Submit
memory/1312-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1312-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1312-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1312-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1668-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1668-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1668-20-0x0000000001670000-0x00000000016EE000-memory.dmp

Filesize
504KB

Download
memory/1668-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download