396514c15cc576af9c3a5bdd5d69e5425d051d5ecd53b32597089f2695083e0f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a63406b23ff0dc56eea143b13854c7e.exe
Size

506KB
MD5

5a63406b23ff0dc56eea143b13854c7e
SHA1

3b7ad1f6247663390c782aeae7f863262780a27f
SHA256

396514c15cc576af9c3a5bdd5d69e5425d051d5ecd53b32597089f2695083e0f
SHA512

765f86d217620b331419a2620f447721d26a19c157915ffd721b67a4ee47aa7e33a232d0732351dadada2501cd50b6cf36570d3ed79fd1d9d7bb2e05d5fa089d
SSDEEP

12288:L+aV0E3JsEG0hQut+F4pAGdZQ1Sa9+/NXSvy4IvLVOOrvbL9sE84An5+X+r0XwVK:L+aV0E3JdG0hQut+F4pTdZQ1Sa9eSvyv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3816	5a63406b23ff0dc56eea143b13854c7e.exe

Executes dropped EXE 1 IoCs

pid	Process
3816	5a63406b23ff0dc56eea143b13854c7e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3816	5a63406b23ff0dc56eea143b13854c7e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	5a63406b23ff0dc56eea143b13854c7e.exe
3816	5a63406b23ff0dc56eea143b13854c7e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2760	5a63406b23ff0dc56eea143b13854c7e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2760	5a63406b23ff0dc56eea143b13854c7e.exe
3816	5a63406b23ff0dc56eea143b13854c7e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3816	2760	5a63406b23ff0dc56eea143b13854c7e.exe	89
PID 2760 wrote to memory of 3816	2760	5a63406b23ff0dc56eea143b13854c7e.exe	89
PID 2760 wrote to memory of 3816	2760	5a63406b23ff0dc56eea143b13854c7e.exe	89
PID 3816 wrote to memory of 2276	3816	5a63406b23ff0dc56eea143b13854c7e.exe	92
PID 3816 wrote to memory of 2276	3816	5a63406b23ff0dc56eea143b13854c7e.exe	92
PID 3816 wrote to memory of 2276	3816	5a63406b23ff0dc56eea143b13854c7e.exe	92

C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe
"C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe
  C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe

Filesize
506KB

MD5
bb434d197afa7a660f2c3fcb45acb9c4

SHA1
fef4330c86547543fc4059abf88f85489c7c2d15

SHA256
f55d18b4ae8bfc47dbaaea88a06c00f3ad1d829aaaa94d10d807e0f95b10fdfe

SHA512
768eadc8a4d74b868ab95c8c1b74b4cc1788af057899b8782ce13ddf52660e3e9aa01d832c607439d3c7eeab66eab36bcadb122ccf90bd1224070ea29b5be40f

Download Submit
memory/2760-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2760-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2760-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2760-12-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3816-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3816-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3816-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3816-20-0x0000000001650000-0x00000000016CE000-memory.dmp

Filesize
504KB

Download
memory/3816-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download