3f77535d886a0c741beecd61e251606b3b63c019f0306746a2c52f19382a1200

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

665cc70a1cdd278e683b75a59f72352e.exe
Size

506KB
MD5

665cc70a1cdd278e683b75a59f72352e
SHA1

18dcb8116e2616eb9e4823a310ee7542863872a4
SHA256

3f77535d886a0c741beecd61e251606b3b63c019f0306746a2c52f19382a1200
SHA512

b2f093f7165d8899531ef46da161f5f06ebdff6fb72441fde20c43fee4361b1b99c84e52412ca83cf19d49e929b0aab02bc12cc5a03582bd1d371eed91041242
SSDEEP

12288:0+/KjA5aljIAsGWp0tq47Umy9wkY/N9W22EEHkEx0h6VVXwsUl4htlVPi7drzcQC:0jQDOKSE/+P1BAq2Q96VBdqPq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3452	665cc70a1cdd278e683b75a59f72352e.exe

Executes dropped EXE 1 IoCs

pid	Process
3452	665cc70a1cdd278e683b75a59f72352e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3452	665cc70a1cdd278e683b75a59f72352e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	665cc70a1cdd278e683b75a59f72352e.exe
3452	665cc70a1cdd278e683b75a59f72352e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4720	665cc70a1cdd278e683b75a59f72352e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4720	665cc70a1cdd278e683b75a59f72352e.exe
3452	665cc70a1cdd278e683b75a59f72352e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3452	4720	665cc70a1cdd278e683b75a59f72352e.exe	86
PID 4720 wrote to memory of 3452	4720	665cc70a1cdd278e683b75a59f72352e.exe	86
PID 4720 wrote to memory of 3452	4720	665cc70a1cdd278e683b75a59f72352e.exe	86
PID 3452 wrote to memory of 2940	3452	665cc70a1cdd278e683b75a59f72352e.exe	91
PID 3452 wrote to memory of 2940	3452	665cc70a1cdd278e683b75a59f72352e.exe	91
PID 3452 wrote to memory of 2940	3452	665cc70a1cdd278e683b75a59f72352e.exe	91

C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe
"C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe
  C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\665cc70a1cdd278e683b75a59f72352e.exe

Filesize
506KB

MD5
1a3bfb2cd1ca33a68c68c20fe18fdc5e

SHA1
5e6f0a7526fecb65ff0d2c052de0a84fc8dae2a2

SHA256
ee7c5e5f0a09d0fa8f725c024af2ef5d1c3509016201fb6665bc1b081361f50b

SHA512
72b6a41d1b99cca5b38618c412196a41a52eb45dcec2fd16593724938a3126e0806528154f90f65dcbe2c4048d998150bc70f2a86c6f3080bdc368a0312492ec

Download Submit
memory/3452-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3452-16-0x0000000001560000-0x00000000015E3000-memory.dmp

Filesize
524KB

Download
memory/3452-20-0x0000000004F40000-0x0000000004FBE000-memory.dmp

Filesize
504KB

Download
memory/3452-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3452-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4720-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4720-1-0x0000000000170000-0x00000000001F3000-memory.dmp

Filesize
524KB

Download
memory/4720-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4720-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download