Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:01
Static task
static1
Behavioral task
behavioral1
Sample
74ec11ce2abb6092698bfe9f12a0a940.exe
Resource
win7-20231129-en
General
-
Target
74ec11ce2abb6092698bfe9f12a0a940.exe
-
Size
1000KB
-
MD5
74ec11ce2abb6092698bfe9f12a0a940
-
SHA1
16c1113a17eed49d4c7e44d48fc285bd358769a3
-
SHA256
93df33c27f484f855e99f9e2e58ac0d390b12704484e33ea580c66563adc35f0
-
SHA512
6b0fd0d826677f2ff9f41517ccfff2a8407bffffe2ef5006c80b549afbdfa93aebc3d71b8a378fd4c0683076811e77db3e77bb4ec5c2d3e00e36107cfef519cd
-
SSDEEP
24576:6wbXlz15/KVh/FquyLN1B+5vMiqt0gj2ed:Bz15/AFJylqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2184 74ec11ce2abb6092698bfe9f12a0a940.exe -
Executes dropped EXE 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2184 74ec11ce2abb6092698bfe9f12a0a940.exe -
Loads dropped DLL 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2904 74ec11ce2abb6092698bfe9f12a0a940.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2184 74ec11ce2abb6092698bfe9f12a0a940.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2184 74ec11ce2abb6092698bfe9f12a0a940.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exepid process 2904 74ec11ce2abb6092698bfe9f12a0a940.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exe74ec11ce2abb6092698bfe9f12a0a940.exepid process 2904 74ec11ce2abb6092698bfe9f12a0a940.exe 2184 74ec11ce2abb6092698bfe9f12a0a940.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
74ec11ce2abb6092698bfe9f12a0a940.exe74ec11ce2abb6092698bfe9f12a0a940.exedescription pid process target process PID 2904 wrote to memory of 2184 2904 74ec11ce2abb6092698bfe9f12a0a940.exe 74ec11ce2abb6092698bfe9f12a0a940.exe PID 2904 wrote to memory of 2184 2904 74ec11ce2abb6092698bfe9f12a0a940.exe 74ec11ce2abb6092698bfe9f12a0a940.exe PID 2904 wrote to memory of 2184 2904 74ec11ce2abb6092698bfe9f12a0a940.exe 74ec11ce2abb6092698bfe9f12a0a940.exe PID 2904 wrote to memory of 2184 2904 74ec11ce2abb6092698bfe9f12a0a940.exe 74ec11ce2abb6092698bfe9f12a0a940.exe PID 2184 wrote to memory of 1468 2184 74ec11ce2abb6092698bfe9f12a0a940.exe schtasks.exe PID 2184 wrote to memory of 1468 2184 74ec11ce2abb6092698bfe9f12a0a940.exe schtasks.exe PID 2184 wrote to memory of 1468 2184 74ec11ce2abb6092698bfe9f12a0a940.exe schtasks.exe PID 2184 wrote to memory of 1468 2184 74ec11ce2abb6092698bfe9f12a0a940.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exe"C:\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exeC:\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarD6E.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\74ec11ce2abb6092698bfe9f12a0a940.exeFilesize
1000KB
MD5bd9fd2633761ce41f16e13bc4289c462
SHA170bdf1b102a7a1ae8a3c36c2c3c70cf9ced77975
SHA256e54a27d74f2ae96dc79671bd8d21ba45b173341988a709bfd82499a690fe350a
SHA512c2c54a83e5658a36897662c5e8ef5ca144f3e399ca647fda1034ff3464b84e56198393d076df4540a3ea24373b851818ab268d5cd788ccd12a4ecedfd37382f2
-
memory/2184-17-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/2184-20-0x0000000000260000-0x00000000002E3000-memory.dmpFilesize
524KB
-
memory/2184-26-0x00000000014F0000-0x000000000156E000-memory.dmpFilesize
504KB
-
memory/2184-23-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2184-66-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2904-0-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/2904-1-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2904-2-0x0000000000260000-0x00000000002E3000-memory.dmpFilesize
524KB
-
memory/2904-14-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB