84dac55f4ec5a4a164f4acf738bdc32b97c4fe45a6081a24d921d40edd56c95f

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7362308913f24248228c3fdc91a6c0c4.exe
Size

1000KB
MD5

7362308913f24248228c3fdc91a6c0c4
SHA1

f90d00e5e48515bcd62d9789fcb08baa4d43d0af
SHA256

84dac55f4ec5a4a164f4acf738bdc32b97c4fe45a6081a24d921d40edd56c95f
SHA512

d49926a352b07b3db61bee8878386216579f6fe8f1dc425b8a47dab7e32c5b6298cff5f328b5b367de885c20a6727d37bc45d3d3b9e412d8efccf5b2973b839a
SSDEEP

12288:FCrja6CbaDWsKj14NaCOY76Mc/F6QqPiQa2XC+WbECaBwQ2tb5JLrnylUPqt0gHj:FCrm40Y5W78nKO1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4688	7362308913f24248228c3fdc91a6c0c4.exe

Executes dropped EXE 1 IoCs

pid	Process
4688	7362308913f24248228c3fdc91a6c0c4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4688	7362308913f24248228c3fdc91a6c0c4.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	7362308913f24248228c3fdc91a6c0c4.exe
4688	7362308913f24248228c3fdc91a6c0c4.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2000	7362308913f24248228c3fdc91a6c0c4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2000	7362308913f24248228c3fdc91a6c0c4.exe
4688	7362308913f24248228c3fdc91a6c0c4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4688	2000	7362308913f24248228c3fdc91a6c0c4.exe	86
PID 2000 wrote to memory of 4688	2000	7362308913f24248228c3fdc91a6c0c4.exe	86
PID 2000 wrote to memory of 4688	2000	7362308913f24248228c3fdc91a6c0c4.exe	86
PID 4688 wrote to memory of 2076	4688	7362308913f24248228c3fdc91a6c0c4.exe	89
PID 4688 wrote to memory of 2076	4688	7362308913f24248228c3fdc91a6c0c4.exe	89
PID 4688 wrote to memory of 2076	4688	7362308913f24248228c3fdc91a6c0c4.exe	89

C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe
"C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe
  C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7362308913f24248228c3fdc91a6c0c4.exe

Filesize
1000KB

MD5
3d0e9bf79820b6f81c34eed348e2eee1

SHA1
08aacc6ae7d3ffab49dde2ad38b9ff1e5867313d

SHA256
c5aa3a9b76218986399328e7c00abf39ddab05d88d7dc11473b3e6a165ac4700

SHA512
eed0dec4d4a83105f9cd8b268fe1bc80c1d7dc5d019b61ae9228a3098e2895b0fa0113581aed87132b9c38a06e63418f9b1c71e16d47fe280743cf6186fa5688

Download Submit
memory/2000-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2000-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2000-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4688-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4688-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4688-20-0x0000000001650000-0x00000000016CE000-memory.dmp

Filesize
504KB

Download
memory/4688-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4688-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download