8f349871dbea668f222ee9a9d0da52630fa18235473cb9e1eb72fea451af8653

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70f827b72ef1f5300ca99086bb35c1ad.exe
Size

1000KB
MD5

70f827b72ef1f5300ca99086bb35c1ad
SHA1

3e2db6aa9b16c9cf7b81b1d65c296c7dedb6876d
SHA256

8f349871dbea668f222ee9a9d0da52630fa18235473cb9e1eb72fea451af8653
SHA512

5fe6214d484be29ca0ec17803e1c6b017002c33ff0451acc4160b83ec6067f72a73bc15c5f2d35d4df0f5dbc350e9e59b23c5f809131ca6f377a7a6e297d580b
SSDEEP

24576:jDl7xbYcsvL+8D9VSeRB1B+5vMiqt0gj2ed:d7xbi/DH9qOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1216	70f827b72ef1f5300ca99086bb35c1ad.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	70f827b72ef1f5300ca99086bb35c1ad.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1216	70f827b72ef1f5300ca99086bb35c1ad.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	70f827b72ef1f5300ca99086bb35c1ad.exe
1216	70f827b72ef1f5300ca99086bb35c1ad.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1636	70f827b72ef1f5300ca99086bb35c1ad.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1636	70f827b72ef1f5300ca99086bb35c1ad.exe
1216	70f827b72ef1f5300ca99086bb35c1ad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1216	1636	70f827b72ef1f5300ca99086bb35c1ad.exe	86
PID 1636 wrote to memory of 1216	1636	70f827b72ef1f5300ca99086bb35c1ad.exe	86
PID 1636 wrote to memory of 1216	1636	70f827b72ef1f5300ca99086bb35c1ad.exe	86
PID 1216 wrote to memory of 1336	1216	70f827b72ef1f5300ca99086bb35c1ad.exe	88
PID 1216 wrote to memory of 1336	1216	70f827b72ef1f5300ca99086bb35c1ad.exe	88
PID 1216 wrote to memory of 1336	1216	70f827b72ef1f5300ca99086bb35c1ad.exe	88

C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe
"C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe
  C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\70f827b72ef1f5300ca99086bb35c1ad.exe

Filesize
719KB

MD5
faf1981b41cf69fa1112f77de1daf7b6

SHA1
5baf8228fff6c4e1cbb6488d3c97e9bf86950e74

SHA256
4c84eadececaee7b2667256962e5b1e7ff8d182faf85e31bc7a9433c7c167738

SHA512
52eeeff583c58fc1571acb7a487f552c7637932554f4f6cf6d627a92b3e1c88e1d65b4acc7a340ee47382abaeead29bb485f171a4a46dc1e88b9c0eb4be36bec

Download Submit
memory/1216-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1216-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1216-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1216-20-0x0000000001650000-0x00000000016CE000-memory.dmp

Filesize
504KB

Download
memory/1216-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1636-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1636-1-0x00000000015E0000-0x0000000001663000-memory.dmp

Filesize
524KB

Download
memory/1636-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1636-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download