fc587251cb48c4d4dd3adf3f5efb81855f6fee2f979ca547403a2a6a49a293a1

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70896c0e706dce9ce88e351a0f818b1e.exe
Size

506KB
MD5

70896c0e706dce9ce88e351a0f818b1e
SHA1

7c8e1a1e35a61c4612738c89d37d9475a62269af
SHA256

fc587251cb48c4d4dd3adf3f5efb81855f6fee2f979ca547403a2a6a49a293a1
SHA512

6bec9f80812328ea849cae6cf15f33a8625cb12224b578b673943698423d867127b8acfecb5b352741b3d6edd0ef07890b27a4642393dfa02660fff42219935d
SSDEEP

12288:smR3FE62UA+kpGIRmeVRFdqt9/fA+K6RLtJBLsHGrVAHd7YV9Ur9XiHYhYE/pVPb:mf4+6L/u59btXPkw

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2332	70896c0e706dce9ce88e351a0f818b1e.exe

Executes dropped EXE 1 IoCs

pid	Process
2332	70896c0e706dce9ce88e351a0f818b1e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2332	70896c0e706dce9ce88e351a0f818b1e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	70896c0e706dce9ce88e351a0f818b1e.exe
2332	70896c0e706dce9ce88e351a0f818b1e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3808	70896c0e706dce9ce88e351a0f818b1e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3808	70896c0e706dce9ce88e351a0f818b1e.exe
2332	70896c0e706dce9ce88e351a0f818b1e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 2332	3808	70896c0e706dce9ce88e351a0f818b1e.exe	84
PID 3808 wrote to memory of 2332	3808	70896c0e706dce9ce88e351a0f818b1e.exe	84
PID 3808 wrote to memory of 2332	3808	70896c0e706dce9ce88e351a0f818b1e.exe	84
PID 2332 wrote to memory of 3864	2332	70896c0e706dce9ce88e351a0f818b1e.exe	88
PID 2332 wrote to memory of 3864	2332	70896c0e706dce9ce88e351a0f818b1e.exe	88
PID 2332 wrote to memory of 3864	2332	70896c0e706dce9ce88e351a0f818b1e.exe	88

C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe
"C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe
  C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\70896c0e706dce9ce88e351a0f818b1e.exe

Filesize
506KB

MD5
c0c7034fb94e574333b37ddf81a86d50

SHA1
c9abcdb7eeb694ecaf8e84e15b220c7c96733bc9

SHA256
f607d6fb04d07136342798800adc168a9c070ebe16a83b7bee10d37d70a15856

SHA512
1bf8e365cc8a016305817086f5620f089d974960f3d795099524e139f2032dc1f4d88c5f3cbb7fe2257f390e32449a1a6fe8d2b1b9c44217c1b4245af9aa6262

Download Submit
memory/2332-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2332-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2332-19-0x0000000004F90000-0x000000000500E000-memory.dmp

Filesize
504KB

Download
memory/2332-26-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3808-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3808-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3808-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3808-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download