3f81b968251a209d27b7d50051547eb639ea40bb347205927d10af0b7f6c733f

Analysis

max time kernel
129s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6fcd7f937a69f5435b7e0021f352b22d.exe
Size

506KB
MD5

6fcd7f937a69f5435b7e0021f352b22d
SHA1

418c931452b9c8d89d9898cadcd0c8dde4ebcbc3
SHA256

3f81b968251a209d27b7d50051547eb639ea40bb347205927d10af0b7f6c733f
SHA512

5f43bc55f75cd7e34054d5ecbe63dec2d6eccdfbcf393548293fe7e098f31446b875b01e36a51ef33ab8eb91fb8b5d642cac01b8e37ab2513bc18c5d38fb243c
SSDEEP

12288:qiae42BhXllW7kvzzl4c4oHC+GCwKMVDMUcIQ1owotDbn:UeVhXbCgR4zgCnTMPIQ1owcDz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
764	6fcd7f937a69f5435b7e0021f352b22d.exe

Executes dropped EXE 1 IoCs

pid	Process
764	6fcd7f937a69f5435b7e0021f352b22d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
764	6fcd7f937a69f5435b7e0021f352b22d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	6fcd7f937a69f5435b7e0021f352b22d.exe
764	6fcd7f937a69f5435b7e0021f352b22d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3568	6fcd7f937a69f5435b7e0021f352b22d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3568	6fcd7f937a69f5435b7e0021f352b22d.exe
764	6fcd7f937a69f5435b7e0021f352b22d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 764	3568	6fcd7f937a69f5435b7e0021f352b22d.exe	35
PID 3568 wrote to memory of 764	3568	6fcd7f937a69f5435b7e0021f352b22d.exe	35
PID 3568 wrote to memory of 764	3568	6fcd7f937a69f5435b7e0021f352b22d.exe	35
PID 764 wrote to memory of 1176	764	6fcd7f937a69f5435b7e0021f352b22d.exe	89
PID 764 wrote to memory of 1176	764	6fcd7f937a69f5435b7e0021f352b22d.exe	89
PID 764 wrote to memory of 1176	764	6fcd7f937a69f5435b7e0021f352b22d.exe	89

C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe
"C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe
  C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6fcd7f937a69f5435b7e0021f352b22d.exe

Filesize
221KB

MD5
01a3e007f3e7b17974704cba572a326b

SHA1
3deb73e1a9758a09bcc4f90d68db294ac4b835ba

SHA256
1114016ff281696622d590cc59bc6c42dffd3a8d8c050c54b915dca955d4f9c8

SHA512
3d420bce15f5a81108f72685b60c92c78fc3be968186c1d052e8b01a3d1f1a270dbfb2ebf7cfb62138fd2c344d7f8622788ba4b20877d6ead29e75f972ef25de

Download Submit
memory/764-14-0x0000000001600000-0x0000000001683000-memory.dmp

Filesize
524KB

Download
memory/764-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/764-20-0x0000000004FA0000-0x000000000501E000-memory.dmp

Filesize
504KB

Download
memory/764-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/764-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3568-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3568-1-0x0000000000160000-0x00000000001E3000-memory.dmp

Filesize
524KB

Download
memory/3568-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3568-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download