Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2024 23:48
Static task
static1
Behavioral task
behavioral1
Sample
59b98713d4f49c257f131f87549ae377.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
59b98713d4f49c257f131f87549ae377.exe
Resource
win10v2004-20231215-en
General
-
Target
59b98713d4f49c257f131f87549ae377.exe
-
Size
1000KB
-
MD5
59b98713d4f49c257f131f87549ae377
-
SHA1
98cd9156e0cb86cbf6ad2986fe12a750bba539b8
-
SHA256
3c1d575ad5c2aee8049faa604d5529e07f944804f7ae45fe8f8b1a6808efd4d4
-
SHA512
5df296e05fb1e04acaa272e9e63b252358013e7e6d1901f0b04c5442134bcf274bcec3d78e1952294a5593bc3a1a1f5a355fa37ea8a5f47680b09a44429ff973
-
SSDEEP
24576:5L4J1F381vvC1nQBDIxId1B+5vMiqt0gj2ed:5cJ1F3vQBDIxIRqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4780 59b98713d4f49c257f131f87549ae377.exe -
Executes dropped EXE 1 IoCs
pid Process 4780 59b98713d4f49c257f131f87549ae377.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4780 59b98713d4f49c257f131f87549ae377.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4780 59b98713d4f49c257f131f87549ae377.exe 4780 59b98713d4f49c257f131f87549ae377.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3468 59b98713d4f49c257f131f87549ae377.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3468 59b98713d4f49c257f131f87549ae377.exe 4780 59b98713d4f49c257f131f87549ae377.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3468 wrote to memory of 4780 3468 59b98713d4f49c257f131f87549ae377.exe 91 PID 3468 wrote to memory of 4780 3468 59b98713d4f49c257f131f87549ae377.exe 91 PID 3468 wrote to memory of 4780 3468 59b98713d4f49c257f131f87549ae377.exe 91 PID 4780 wrote to memory of 2792 4780 59b98713d4f49c257f131f87549ae377.exe 92 PID 4780 wrote to memory of 2792 4780 59b98713d4f49c257f131f87549ae377.exe 92 PID 4780 wrote to memory of 2792 4780 59b98713d4f49c257f131f87549ae377.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b98713d4f49c257f131f87549ae377.exe"C:\Users\Admin\AppData\Local\Temp\59b98713d4f49c257f131f87549ae377.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\59b98713d4f49c257f131f87549ae377.exeC:\Users\Admin\AppData\Local\Temp\59b98713d4f49c257f131f87549ae377.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\59b98713d4f49c257f131f87549ae377.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2792
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD5fd0f00f3dc700003e941818abb85239b
SHA19e091f274984f998c2eb8086b6b3e04e5cfa63cc
SHA256e0a5d850777b9460b342edfebcfa8908df61c94cb8370abefabcd4bb5f9d3322
SHA512f93225f4d06b0e865d9a3c0ad8d7a744e753f322b8cee6920f61e7b24d8ac9802403bdf54e3f1ae8dce1eee5868cf48ec19891d99f82ee3b41b36a4d533542e1