5396ffe4adbd6bb32a07e4be7349dd41199d66f8bec3250d9aa2e574169f7140

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

769b6b751a8f67f0651042dc90188e6d.exe
Size

506KB
MD5

769b6b751a8f67f0651042dc90188e6d
SHA1

1639c1c51f391ff82fbfba3d69d2d5b9d3ef63b4
SHA256

5396ffe4adbd6bb32a07e4be7349dd41199d66f8bec3250d9aa2e574169f7140
SHA512

a7a57074bce91d493be6fa9c289bd4621822f9d0665b476cd046e3a7151940403e711045f866a4473108765b0fe462dba0dd9fca1c49dd43f168a5eb6ef0ed98
SSDEEP

12288:4I8eZ8Hon/77zo8z+hqt6gj2FyV5gOVyokMUVd:/8Wz9+ej20VHyokZ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1396	769b6b751a8f67f0651042dc90188e6d.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	769b6b751a8f67f0651042dc90188e6d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1396	769b6b751a8f67f0651042dc90188e6d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	769b6b751a8f67f0651042dc90188e6d.exe
1396	769b6b751a8f67f0651042dc90188e6d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1888	769b6b751a8f67f0651042dc90188e6d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1888	769b6b751a8f67f0651042dc90188e6d.exe
1396	769b6b751a8f67f0651042dc90188e6d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1396	1888	769b6b751a8f67f0651042dc90188e6d.exe	89
PID 1888 wrote to memory of 1396	1888	769b6b751a8f67f0651042dc90188e6d.exe	89
PID 1888 wrote to memory of 1396	1888	769b6b751a8f67f0651042dc90188e6d.exe	89
PID 1396 wrote to memory of 4200	1396	769b6b751a8f67f0651042dc90188e6d.exe	91
PID 1396 wrote to memory of 4200	1396	769b6b751a8f67f0651042dc90188e6d.exe	91
PID 1396 wrote to memory of 4200	1396	769b6b751a8f67f0651042dc90188e6d.exe	91

C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe
"C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe
  C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\769b6b751a8f67f0651042dc90188e6d.exe

Filesize
506KB

MD5
684d112cee069f2c5e735130b5c13c19

SHA1
d5b5ad1ca54761a2b7bba600bdf947bfe23a3f7a

SHA256
a8830a25ed82cfe26988914ac19cb132fea2e03d0ad5591513e5876ebcb22352

SHA512
3736d548ac980c14566bfbbea11515d4df31601d1a558209f43348aa23c64f9824a7ff8c4f0107dc06fdc6c721af417cf642824887ef2ca20c00913093b4bb9f

Download Submit
memory/1396-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1396-16-0x0000000001620000-0x00000000016A3000-memory.dmp

Filesize
524KB

Download
memory/1396-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1396-22-0x0000000004F30000-0x0000000004FAE000-memory.dmp

Filesize
504KB

Download
memory/1396-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1888-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1888-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1888-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1888-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download