146c06e61924240d27f9f43538273504841bbdf96c92a7ba4da93a50512aa8db

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
Size 506KB
Sample240203-n6agtaged6
SHA256 146c06e61924240d27f9f43538273504841bbdf96c92a7ba4da93a50512aa8db
MD5 8c455ed7b8cf4ec664ee83b8fc98bf7f
SHA1 34c2638ae11cb6b736b225e9050266ced0915d9d
SHA512 aac7bdb214379b71c326d9faa2639bab2d2c4cd50516f6055da1442b8579f8108b87ba990ee1cebf0a51ce31d094d256bf6448a3c733a1aa165dc46908c95229
SSDEEP 12288:kkMuqlcCszZGEIa6Xmv7LBXV4kEA4YOzLe9VmhcSyj+KBu6AQ:kTuqO3yJXm9V4/AwzLnh6jJMQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Executes dropped EXE 1 IoCs

pid	Process
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4612	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4612	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3504	4612	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	84
PID 4612 wrote to memory of 3504	4612	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	84
PID 4612 wrote to memory of 3504	4612	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	84
PID 3504 wrote to memory of 3328	3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	85
PID 3504 wrote to memory of 3328	3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	85
PID 3504 wrote to memory of 3328	3504	8c455ed7b8cf4ec664ee83b8fc98bf7f.exe	85

C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
"C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
  C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8c455ed7b8cf4ec664ee83b8fc98bf7f.exe

Path C:\Users\Admin\AppData\Local\Temp\8c455ed7b8cf4ec664ee83b8fc98bf7f.exe
Size 506KB
SHA256 851fd01b40f8eedc2893bb810921edb3865faed224392c8cdac3f9e22142b16a
MD5 80ab9865a82b8ce7082c8575028f53aa
SHA1 af2d0819209b27abc8b2ec8a9fd17ad567863da1
SHA512 9f1dab3f914e7768e8f174910b4c4f4d69173b7fa8d458cec67e0610965ffd42b459dd98f19f5c2cb473d652bc496511cae8d86d5af777c186762c2779210f2e
SSDEEP 12288:WZ8VuDqf91WHmFM0ltA45nj8e3bGMmIyIonYA/iSP9E2nz9CJQgWn4Y:WGVuDqfPUEMWGinP3HmIs/3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3504-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/3504-15-0x0000000000170000-0x00000000001F3000-memory.dmp

Download

memory/3504-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Download

memory/3504-21-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3504-27-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/4612-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4612-1-0x0000000001510000-0x0000000001593000-memory.dmp

Download

memory/4612-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4612-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download