9694bd61aa0cfc74bdd4d8872b87f8d594786e9cd2ed718927e92e7664ed75ee

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59cf4a033558c302a5025447d2b1240b.exe
Size

241KB
MD5

59cf4a033558c302a5025447d2b1240b
SHA1

0726d68013b6cce017c0c0a10e5362736197e84d
SHA256

9694bd61aa0cfc74bdd4d8872b87f8d594786e9cd2ed718927e92e7664ed75ee
SHA512

66dbb89916e241868a8c6d8690f9e930c3cbe966b850be2f8ea3a860b0da05f75eae1cd42bdff8e2841951fa067249aa8cf8c780d6e1db2ec112caa9502dd516
SSDEEP

6144:xROoiVfzCWfrFEimfyaqxkGcX290T//Zya622B9AmPBp:x9yj4fyaqC/X2M/ZyH3Bp

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3948	59cf4a033558c302a5025447d2b1240b.exe

Executes dropped EXE 1 IoCs

pid	Process
3948	59cf4a033558c302a5025447d2b1240b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3948	59cf4a033558c302a5025447d2b1240b.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	59cf4a033558c302a5025447d2b1240b.exe
3948	59cf4a033558c302a5025447d2b1240b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3172	59cf4a033558c302a5025447d2b1240b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3172	59cf4a033558c302a5025447d2b1240b.exe
3948	59cf4a033558c302a5025447d2b1240b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3948	3172	59cf4a033558c302a5025447d2b1240b.exe	91
PID 3172 wrote to memory of 3948	3172	59cf4a033558c302a5025447d2b1240b.exe	91
PID 3172 wrote to memory of 3948	3172	59cf4a033558c302a5025447d2b1240b.exe	91
PID 3948 wrote to memory of 2464	3948	59cf4a033558c302a5025447d2b1240b.exe	93
PID 3948 wrote to memory of 2464	3948	59cf4a033558c302a5025447d2b1240b.exe	93
PID 3948 wrote to memory of 2464	3948	59cf4a033558c302a5025447d2b1240b.exe	93

C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe
"C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe
  C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\59cf4a033558c302a5025447d2b1240b.exe

Filesize
241KB

MD5
f598ee6b978fecc3d173017695b6262d

SHA1
9ace04612547070306ddd135309b18bf40f835b7

SHA256
d5124bd3c450ded3e6263a363b856f03592dbf6152efdc4470b7d7497f9e6b8b

SHA512
dd2ae91eeaa921a9f1c78438166e87fb12c66e2b9d8d56dbfe4ef94f3433eda10dd28fd154ffaee29779ef2a5b866d99c8dc4699fb8b60d7d47aa33cf1440ebd

Download Submit
memory/3172-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3172-1-0x0000000001640000-0x00000000016F7000-memory.dmp

Filesize
732KB

Download
memory/3172-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3172-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3948-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3948-15-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3948-14-0x00000000014C0000-0x0000000001577000-memory.dmp

Filesize
732KB

Download
memory/3948-20-0x0000000001690000-0x00000000016F6000-memory.dmp

Filesize
408KB

Download
memory/3948-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download