258f18f8d5b3ff5b76a1c09ec5cd224cd028e9340bde81b61495534a549ac015

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fbb02c32e025162462d57f9a19985bb.exe
Size

506KB
MD5

8fbb02c32e025162462d57f9a19985bb
SHA1

13a8179ce4b00dd7df8bcbd297d0ef838e9df5ee
SHA256

258f18f8d5b3ff5b76a1c09ec5cd224cd028e9340bde81b61495534a549ac015
SHA512

ef49ae6453f188a8c3e4b622ed18311b12fcd7c3775f8d682a52eec0808502729915115a4acdc7495b4372a51f8592a64c5295f6cf9197fb08f2ef87ca1761ce
SSDEEP

12288:/apqvYuCg/NtO5MTQelYmx7/+cfSC36QRT1gdTYt4u9OnllX:/axog5E3/+CqQx1QA4AOnH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2600	8fbb02c32e025162462d57f9a19985bb.exe

Executes dropped EXE 1 IoCs

pid	Process
2600	8fbb02c32e025162462d57f9a19985bb.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	pastebin.com
16	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2600	8fbb02c32e025162462d57f9a19985bb.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	8fbb02c32e025162462d57f9a19985bb.exe
2600	8fbb02c32e025162462d57f9a19985bb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1088	8fbb02c32e025162462d57f9a19985bb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1088	8fbb02c32e025162462d57f9a19985bb.exe
2600	8fbb02c32e025162462d57f9a19985bb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2600	1088	8fbb02c32e025162462d57f9a19985bb.exe	84
PID 1088 wrote to memory of 2600	1088	8fbb02c32e025162462d57f9a19985bb.exe	84
PID 1088 wrote to memory of 2600	1088	8fbb02c32e025162462d57f9a19985bb.exe	84
PID 2600 wrote to memory of 1756	2600	8fbb02c32e025162462d57f9a19985bb.exe	85
PID 2600 wrote to memory of 1756	2600	8fbb02c32e025162462d57f9a19985bb.exe	85
PID 2600 wrote to memory of 1756	2600	8fbb02c32e025162462d57f9a19985bb.exe	85

C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe
"C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe
  C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8fbb02c32e025162462d57f9a19985bb.exe

Filesize
506KB

MD5
3ddb575d74b9b51df70b9402639786f0

SHA1
27b688e99877a66c8241f8eb18034c9d7301dc9b

SHA256
ccf60b0e156f88e4da7fa3df25a9b08fb3ac99070992caa712bb996dae2c9584

SHA512
ae32bbf3d22073a86422024af13086f0a7a6ddd5a160a39673edec2f0dc7723cd9568352c9c6ce75449256d07e46de1a7b80e1112dc554f9b5f69a752f29b537

Download Submit
memory/1088-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1088-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1088-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1088-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2600-15-0x0000000000160000-0x00000000001E3000-memory.dmp

Filesize
524KB

Download
memory/2600-20-0x0000000004F40000-0x0000000004FBE000-memory.dmp

Filesize
504KB

Download
memory/2600-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2600-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download