870450ab30978a78b186d7116a86182055ca8d774f34b105fe238a05ff1b6e4e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a0f8a7eb2326142487cbd8796f4f1ce.exe
Size 1000KB
Sample240114-c5sq8abfc4
SHA256 870450ab30978a78b186d7116a86182055ca8d774f34b105fe238a05ff1b6e4e
MD5 5a0f8a7eb2326142487cbd8796f4f1ce
SHA1 373f67b7e0067f20b4b6b107d4b13b0d97418396
SHA512 1e9d66655a01dde11f62b95866d72b3ebca7c9db21af62dd58cdfd2b9e57561526b0c3544518e2294de235b59a93dd8e31534a27be3093deea8b2bd772544525
SSDEEP 12288:4M0kRYC0diPTJjECkDLSU5cd2e4m82ryNMHeuiFECaBwQ2tb5JLrnylUPqt0gHDv:J0Xobpen5Un4s9+N+1B+5vMiqt0gj2ed
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Executes dropped EXE 1 IoCs

pid	Process
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2748	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2748	5a0f8a7eb2326142487cbd8796f4f1ce.exe
1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1808	2748	5a0f8a7eb2326142487cbd8796f4f1ce.exe	89
PID 2748 wrote to memory of 1808	2748	5a0f8a7eb2326142487cbd8796f4f1ce.exe	89
PID 2748 wrote to memory of 1808	2748	5a0f8a7eb2326142487cbd8796f4f1ce.exe	89
PID 1808 wrote to memory of 3236	1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe	93
PID 1808 wrote to memory of 3236	1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe	93
PID 1808 wrote to memory of 3236	1808	5a0f8a7eb2326142487cbd8796f4f1ce.exe	93

C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe
"C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe
  C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a0f8a7eb2326142487cbd8796f4f1ce.exe

Path C:\Users\Admin\AppData\Local\Temp\5a0f8a7eb2326142487cbd8796f4f1ce.exe
Size 753KB
SHA256 03085e66cb1b7431ca8e7ff44a46ce90ec2785c78a508a962c7ba4849fdeb4e9
MD5 ed22b26a598a311efd382f324bbab90c
SHA1 4fe4e10d605436fff035cce58030fa94e7f3739d
SHA512 9c5159f8fb6a8df4197373294a21b05c0330c679cd69705bd4d21d49e7e3cbb0dcd1c6029b2660e2498a7412a8cf48d8b3fed9e453cea0dbf0c707176486c154
SSDEEP 12288:4g/Jqq/a8QfpbxI5qkJXM5XrrfoCfjiJVqU1+hKBqPVudpwiA4D+C4DhNfJmFp0F:4gBy8QyxhsXdjivzshKBqPVudpwZ4D+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1808-14-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1808-17-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/1808-20-0x0000000004F40000-0x0000000004FBE000-memory.dmp

Download

memory/1808-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1808-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2748-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2748-1-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/2748-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2748-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download