Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-01-2024 16:14
General
-
Target
74f2109124f3f6fed6b33657e13db3d7.exe
-
Size
506KB
-
MD5
74f2109124f3f6fed6b33657e13db3d7
-
SHA1
8743e6c7389539f7a371487b966ce37819575269
-
SHA256
050e4dfa4905b776eb18859d462cad4467da27b4cceaf0a778a8f0f7596a81fb
-
SHA512
f75d03c668047e4509e86f39a7da915bc8eaff0656e0b1ada3b47ac1211bafc2023afc128b816f87a9db48150067b7e2a5e14dfea2bd0e91285412304cbcd149
-
SSDEEP
12288:F6+uDDCWVNiIjKEiefJyZGTA09KsozYyutzzS:FQvBVNSEi28ZGdgv9ux2
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe"C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exeC:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar1164.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\74f2109124f3f6fed6b33657e13db3d7.exeFilesize
506KB
MD55858a7fc1e5895d1026930a00147b646
SHA1d85468b2279c720c2cd47a774ce0a8de10de7cd1
SHA2568edec13fbd3db12eccc489a1d34a03ac6bc6abdefb3cc6f35fa7d2bdf15ea97c
SHA512654e3ed573dc8a5322db3b4d5e6f7b851aa7fbeeeb52dd77151132e7d8193d36c1b306893d66a4e9a0a56c69b37bb3be5b373f5b48111ad7de85f7c0c5ded380
-
memory/1392-28-0x0000000002DD0000-0x0000000002E4E000-memory.dmpFilesize
504KB
-
memory/1392-18-0x0000000000370000-0x00000000003F3000-memory.dmpFilesize
524KB
-
memory/1392-21-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/1392-24-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1392-67-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2032-15-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2032-12-0x0000000001490000-0x0000000001513000-memory.dmpFilesize
524KB
-
memory/2032-1-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2032-2-0x0000000000350000-0x00000000003D3000-memory.dmpFilesize
524KB
-
memory/2032-0-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB