a830869b6826f62df46be425d65e10c3216e6756ab12a76455a7542eaec8fb9b

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ba6f7d6931a09033e873b02ea859beb.exe
Size 1000KB
Sample240203-hdrbzabcg3
SHA256 a830869b6826f62df46be425d65e10c3216e6756ab12a76455a7542eaec8fb9b
MD5 8ba6f7d6931a09033e873b02ea859beb
SHA1 49ad7abae31c701c300316c75fd2ff3694748473
SHA512 5260b4fd7dec4c4d491790489347c0b2caec169bf3c719c04a2bfaf01703f6ba3bc3f9a7be6c28b20c55cb4eb0972efc98d7373d678afc5d1bb4350623113fb2
SSDEEP 24576:0jzDOKSE/+P1BAq2Q96VBdqPR1B+5vMiqt0gj2ed:0yKNGg/cGBmqOL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3752	8ba6f7d6931a09033e873b02ea859beb.exe

Executes dropped EXE 1 IoCs

pid	Process
3752	8ba6f7d6931a09033e873b02ea859beb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
6	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3752	8ba6f7d6931a09033e873b02ea859beb.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	8ba6f7d6931a09033e873b02ea859beb.exe
3752	8ba6f7d6931a09033e873b02ea859beb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3252	8ba6f7d6931a09033e873b02ea859beb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3252	8ba6f7d6931a09033e873b02ea859beb.exe
3752	8ba6f7d6931a09033e873b02ea859beb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3752	3252	8ba6f7d6931a09033e873b02ea859beb.exe	83
PID 3252 wrote to memory of 3752	3252	8ba6f7d6931a09033e873b02ea859beb.exe	83
PID 3252 wrote to memory of 3752	3252	8ba6f7d6931a09033e873b02ea859beb.exe	83
PID 3752 wrote to memory of 3792	3752	8ba6f7d6931a09033e873b02ea859beb.exe	84
PID 3752 wrote to memory of 3792	3752	8ba6f7d6931a09033e873b02ea859beb.exe	84
PID 3752 wrote to memory of 3792	3752	8ba6f7d6931a09033e873b02ea859beb.exe	84

C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe
"C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe
  C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8ba6f7d6931a09033e873b02ea859beb.exe

Path C:\Users\Admin\AppData\Local\Temp\8ba6f7d6931a09033e873b02ea859beb.exe
Size 576KB
SHA256 b90a838f94a9e39fb102d2237b802540504fb20dbfa30ed6e8a0acad7a21e1ac
MD5 549c8b25370d0897f4c1a5b1c2951cc9
SHA1 0070cee35c19bfc6a1dc7e679823af426e9a6236
SHA512 1338410b28e615e12bec9a4ba3adbc6c0a679e639ea594c7a4a70eb28adb9951222743eebd32baec22ccd75c00fbc646a66fb8e2a024a67c586b2603e109cc66
SSDEEP 12288:3KPg3I5sJfxuteI9xM6iopqbdtn+ShXiUXWq4TyECaB/:0g3+QY9apo6n+ShXsN11B/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3252-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/3252-1-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/3252-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3252-12-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3752-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/3752-14-0x0000000001690000-0x0000000001713000-memory.dmp

Download

memory/3752-20-0x0000000004F20000-0x0000000004F9E000-memory.dmp

Download

memory/3752-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3752-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download