48f20f2316f366a273cd8d9be10ec7c6feb8b1dc6a6c3b2866d2d26e40628967

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7586acbdd2d27c60c3a99079c9ace696.exe
Size

506KB
MD5

7586acbdd2d27c60c3a99079c9ace696
SHA1

0765a607ba13dc689a19092c204d4f6f0bc16c6b
SHA256

48f20f2316f366a273cd8d9be10ec7c6feb8b1dc6a6c3b2866d2d26e40628967
SHA512

c5beadbf7d8a03c6d741a34fdde67df3834f714c2e1ebe6a28cd536100149acd95497aaa4281c556da093e1d4a001b7856a2fb817ff2b245f788cc72166dc646
SSDEEP

12288:2uetzv7De2/jm32dUI7Mt60VfqJadHGrhrMUvcrlu:6zzi+y3CUI7MBVfEadKhrulu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4572	7586acbdd2d27c60c3a99079c9ace696.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	7586acbdd2d27c60c3a99079c9ace696.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4572	7586acbdd2d27c60c3a99079c9ace696.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4572	7586acbdd2d27c60c3a99079c9ace696.exe
4572	7586acbdd2d27c60c3a99079c9ace696.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4496	7586acbdd2d27c60c3a99079c9ace696.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4496	7586acbdd2d27c60c3a99079c9ace696.exe
4572	7586acbdd2d27c60c3a99079c9ace696.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4572	4496	7586acbdd2d27c60c3a99079c9ace696.exe	86
PID 4496 wrote to memory of 4572	4496	7586acbdd2d27c60c3a99079c9ace696.exe	86
PID 4496 wrote to memory of 4572	4496	7586acbdd2d27c60c3a99079c9ace696.exe	86
PID 4572 wrote to memory of 4580	4572	7586acbdd2d27c60c3a99079c9ace696.exe	91
PID 4572 wrote to memory of 4580	4572	7586acbdd2d27c60c3a99079c9ace696.exe	91
PID 4572 wrote to memory of 4580	4572	7586acbdd2d27c60c3a99079c9ace696.exe	91

C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe
"C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe
  C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7586acbdd2d27c60c3a99079c9ace696.exe

Filesize
506KB

MD5
665799f9c02e254989a89d91d35d77c0

SHA1
01e075c8231c8a69e53c1914eb430748b72f5d99

SHA256
51e0418d2e086f488a5699a79b2f7f506bebaab3b2bb0cba5b09bee1530732ed

SHA512
160397c3d9300cffb7968fc085a17d421bf04771f28a625572da78e1bd03551512877a2c895541dfb330272904667e62fbbe1049b82b57ce6173e10370e1af12

Download Submit
memory/4496-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4496-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4496-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4496-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4572-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4572-15-0x0000000001620000-0x00000000016A3000-memory.dmp

Filesize
524KB

Download
memory/4572-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4572-20-0x0000000004F80000-0x0000000004FFE000-memory.dmp

Filesize
504KB

Download
memory/4572-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download