97f9a98bad32d0059594f938b6f3328f7baee90d71a6e50f20896ad00af4579a

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f2292e72a784800d35d2130cd852b4b.exe
Size

506KB
MD5

8f2292e72a784800d35d2130cd852b4b
SHA1

a87899d15d813ea4fb4ebe46ad7e23e0ce36d6fa
SHA256

97f9a98bad32d0059594f938b6f3328f7baee90d71a6e50f20896ad00af4579a
SHA512

c3e55826d3170700e5c8e7d6ece6e9206521956152512f97895638d412d8bb6c2b434a85e388522c8e6cbbb0315b7f72c1936841c707e36c2a5a9ff74dc86cf0
SSDEEP

12288:eyBKi0gXVW5Ay7NRD1uCPolj7xDOhvackLAXMAZlmHkTe+tXcsm3I3dcUh:eyBKiFE5nXhPC7xyCDMXMAZlmHkTe+tF

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1176	8f2292e72a784800d35d2130cd852b4b.exe

Executes dropped EXE 1 IoCs

pid	Process
1176	8f2292e72a784800d35d2130cd852b4b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
11	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1176	8f2292e72a784800d35d2130cd852b4b.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	8f2292e72a784800d35d2130cd852b4b.exe
1176	8f2292e72a784800d35d2130cd852b4b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4928	8f2292e72a784800d35d2130cd852b4b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4928	8f2292e72a784800d35d2130cd852b4b.exe
1176	8f2292e72a784800d35d2130cd852b4b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1176	4928	8f2292e72a784800d35d2130cd852b4b.exe	84
PID 4928 wrote to memory of 1176	4928	8f2292e72a784800d35d2130cd852b4b.exe	84
PID 4928 wrote to memory of 1176	4928	8f2292e72a784800d35d2130cd852b4b.exe	84
PID 1176 wrote to memory of 3588	1176	8f2292e72a784800d35d2130cd852b4b.exe	86
PID 1176 wrote to memory of 3588	1176	8f2292e72a784800d35d2130cd852b4b.exe	86
PID 1176 wrote to memory of 3588	1176	8f2292e72a784800d35d2130cd852b4b.exe	86

C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe
"C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe
  C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8f2292e72a784800d35d2130cd852b4b.exe

Filesize
506KB

MD5
3b535814eaaeedd7c5b8d079e267a604

SHA1
0d4cb2c24a55a9f6394e30d10fc646347fbf3e89

SHA256
c1846893443ea102d6352ff359ac96259eea71f0a8d61d5295e8a1ccba0e7110

SHA512
48f1953bf24bf1c406909b121bac5990a8ce18d536a2af84e0a96e2cb9e6da9643b24f3d3a93170316113fc8b1a5df2d71074736218edb80ce34b57f32730999

Download Submit
memory/1176-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1176-16-0x0000000001620000-0x00000000016A3000-memory.dmp

Filesize
524KB

Download
memory/1176-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/1176-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1176-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4928-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4928-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4928-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4928-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download