381faecab7f720fdb06e35a03307c513e6f09b42c4f9acbb25e6a3e445679ed7

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d4d9b10112a945160ed665f36912b17.exe
Size 1000KB
Sample240128-slhd5sccc6
SHA256 381faecab7f720fdb06e35a03307c513e6f09b42c4f9acbb25e6a3e445679ed7
MD5 7d4d9b10112a945160ed665f36912b17
SHA1 b9152536424b5267967eec6697ef160946517dd9
SHA512 ebd5c59dbf3e23221aa577bf03bf196cac8037d586087b5a0ff797a512bd439fe2603e274711eebd9562e1d396c5a3068a33cdafd61e423fec987c1c99791f67
SSDEEP 24576:AcYQ6bw7MpS3//Bi7HE731B+5vMiqt0gj2ed:Ac0w7C4h26qOL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1244	7d4d9b10112a945160ed665f36912b17.exe

Executes dropped EXE 1 IoCs

pid	Process
1244	7d4d9b10112a945160ed665f36912b17.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com
14	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1244	7d4d9b10112a945160ed665f36912b17.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	7d4d9b10112a945160ed665f36912b17.exe
1244	7d4d9b10112a945160ed665f36912b17.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2464	7d4d9b10112a945160ed665f36912b17.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2464	7d4d9b10112a945160ed665f36912b17.exe
1244	7d4d9b10112a945160ed665f36912b17.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1244	2464	7d4d9b10112a945160ed665f36912b17.exe	84
PID 2464 wrote to memory of 1244	2464	7d4d9b10112a945160ed665f36912b17.exe	84
PID 2464 wrote to memory of 1244	2464	7d4d9b10112a945160ed665f36912b17.exe	84
PID 1244 wrote to memory of 336	1244	7d4d9b10112a945160ed665f36912b17.exe	85
PID 1244 wrote to memory of 336	1244	7d4d9b10112a945160ed665f36912b17.exe	85
PID 1244 wrote to memory of 336	1244	7d4d9b10112a945160ed665f36912b17.exe	85

C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe
"C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe
  C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7d4d9b10112a945160ed665f36912b17.exe

Path C:\Users\Admin\AppData\Local\Temp\7d4d9b10112a945160ed665f36912b17.exe
Size 1000KB
SHA256 826c29c766190a31378e5867d30ba7ed612ecce3a36fbb41ee83e8c60b7f3ec2
MD5 e6f5f4b27a85cb02972928f923e9ca4d
SHA1 579f12c3daf4e236551bd6ea1bf410c9dc0ccf54
SHA512 2c1925872bde0d5077e2bdab9fe4f1fd842590e31eb637b81bf20cf584591574ef4033cfb45507168006b42c941dc0697c45a7de8270afeadd515d9f2249c067
SSDEEP 12288:6yRIB9txRe1ah4jlj5mZUm9iewoBt/xOrXot+aBXrGECaBwQ2tb5JLrnylUPqt0A:QuT5EZwoB1xOyV1B+5vMiqt0gj2ed
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1244-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1244-15-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/1244-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1244-20-0x0000000001680000-0x00000000016FE000-memory.dmp

Download

memory/1244-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/2464-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2464-1-0x0000000001620000-0x00000000016A3000-memory.dmp

Download

memory/2464-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2464-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download