8d68392f4ac39fa4ed5404f5cfb112790630b6e8160b563218d9c65fb087fbb2

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713b77a6175a61f9c4261f2529e22595.exe
Size

1000KB
MD5

713b77a6175a61f9c4261f2529e22595
SHA1

1402667ffd1d77a481d05e47c7f48e476c81103c
SHA256

8d68392f4ac39fa4ed5404f5cfb112790630b6e8160b563218d9c65fb087fbb2
SHA512

71ef12bd5441e4905e95ca26fefac44cf61ed7267d0aeafe871b43ecaec1c0614a920be6e6afacc988229fb82c2415eff7b2ec0d62b60e1fd5ae33e133517f65
SSDEEP

24576:VpcmXdXtvHQ35xoGtC6fthOUf5Ui1B+5vMiqt0gj2ed:PcedXpGxo/GXeoqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	713b77a6175a61f9c4261f2529e22595.exe

Executes dropped EXE 1 IoCs

pid	Process
2816	713b77a6175a61f9c4261f2529e22595.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2816	713b77a6175a61f9c4261f2529e22595.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	713b77a6175a61f9c4261f2529e22595.exe
2816	713b77a6175a61f9c4261f2529e22595.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3208	713b77a6175a61f9c4261f2529e22595.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3208	713b77a6175a61f9c4261f2529e22595.exe
2816	713b77a6175a61f9c4261f2529e22595.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 2816	3208	713b77a6175a61f9c4261f2529e22595.exe	88
PID 3208 wrote to memory of 2816	3208	713b77a6175a61f9c4261f2529e22595.exe	88
PID 3208 wrote to memory of 2816	3208	713b77a6175a61f9c4261f2529e22595.exe	88
PID 2816 wrote to memory of 452	2816	713b77a6175a61f9c4261f2529e22595.exe	90
PID 2816 wrote to memory of 452	2816	713b77a6175a61f9c4261f2529e22595.exe	90
PID 2816 wrote to memory of 452	2816	713b77a6175a61f9c4261f2529e22595.exe	90

C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe
"C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe
  C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\713b77a6175a61f9c4261f2529e22595.exe

Filesize
192KB

MD5
b5d168907caf99da3bc5783245ec7ada

SHA1
2079a120ce3cc272e1115ab0ee8425ac723e2db3

SHA256
dc2b13a24505ac1636b5629bbc6623bdc5b790e96d369d0b1ff8a5c0d21e6dfa

SHA512
9ff53a66b92cd35c78d6282a419a9fe26a0306c513b29617d6a72de8991957c24c398d6955aab0bf60cf7f59758b694c5fb6adba8ee27d8207444167c165aab7

Download Submit
memory/2816-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2816-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2816-20-0x0000000004F80000-0x0000000004FFE000-memory.dmp

Filesize
504KB

Download
memory/2816-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2816-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3208-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3208-1-0x0000000000150000-0x00000000001D3000-memory.dmp

Filesize
524KB

Download
memory/3208-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3208-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download