Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:39
Static task
static1
Behavioral task
behavioral1
Sample
74fd5b707557c2def642ac033c7b3e2f.exe
Resource
win7-20231129-en
General
-
Target
74fd5b707557c2def642ac033c7b3e2f.exe
-
Size
1000KB
-
MD5
74fd5b707557c2def642ac033c7b3e2f
-
SHA1
9f53d7470d0c9f03d5cebe139affd884a1ae80c5
-
SHA256
23e410d5a2962b92e61f25dba35585371524de95e886291564dbd61f011bd71f
-
SHA512
5300940b74ed9c31966c27bbf52fd4fc0021a72f8a8c27b07c0590a636848544e8b290e4639b0a614359c7bf9d373ffb1663b7ad02a0cd3491cbfe14b400ab65
-
SSDEEP
24576:3xdjpaMpV6BJJCCJ+uM71B+5vMiqt0gj2ed:3rjpa8aCCAuQqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exepid process 4240 74fd5b707557c2def642ac033c7b3e2f.exe -
Executes dropped EXE 1 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exepid process 4240 74fd5b707557c2def642ac033c7b3e2f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exepid process 4240 74fd5b707557c2def642ac033c7b3e2f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exepid process 4240 74fd5b707557c2def642ac033c7b3e2f.exe 4240 74fd5b707557c2def642ac033c7b3e2f.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exepid process 2180 74fd5b707557c2def642ac033c7b3e2f.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exe74fd5b707557c2def642ac033c7b3e2f.exepid process 2180 74fd5b707557c2def642ac033c7b3e2f.exe 4240 74fd5b707557c2def642ac033c7b3e2f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
74fd5b707557c2def642ac033c7b3e2f.exe74fd5b707557c2def642ac033c7b3e2f.exedescription pid process target process PID 2180 wrote to memory of 4240 2180 74fd5b707557c2def642ac033c7b3e2f.exe 74fd5b707557c2def642ac033c7b3e2f.exe PID 2180 wrote to memory of 4240 2180 74fd5b707557c2def642ac033c7b3e2f.exe 74fd5b707557c2def642ac033c7b3e2f.exe PID 2180 wrote to memory of 4240 2180 74fd5b707557c2def642ac033c7b3e2f.exe 74fd5b707557c2def642ac033c7b3e2f.exe PID 4240 wrote to memory of 2168 4240 74fd5b707557c2def642ac033c7b3e2f.exe schtasks.exe PID 4240 wrote to memory of 2168 4240 74fd5b707557c2def642ac033c7b3e2f.exe schtasks.exe PID 4240 wrote to memory of 2168 4240 74fd5b707557c2def642ac033c7b3e2f.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exe"C:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exeC:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\74fd5b707557c2def642ac033c7b3e2f.exeFilesize
1000KB
MD51b8c8c02c28bc8b0724c15cc6e93cdef
SHA19b76ff84775929a9aa1fb0a07d4709a09820249e
SHA2561f6ea85475dcf6ca351bb0e34324cc46b6fe0aa5414a4b2907bc33ab484b9669
SHA5127814171ea6c0fffccfb8030f03bf6203812fc46e97eb62f2f19f3b2937ffbfb44d528ae70cd99d54c5d8a1b73ef57ebc49734da1535617df812bd213f7e08df6
-
memory/2180-0-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/2180-1-0x0000000001630000-0x00000000016B3000-memory.dmpFilesize
524KB
-
memory/2180-2-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2180-11-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4240-13-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/4240-15-0x0000000001510000-0x0000000001593000-memory.dmpFilesize
524KB
-
memory/4240-20-0x0000000004FE0000-0x000000000505E000-memory.dmpFilesize
504KB
-
memory/4240-21-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4240-27-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB