6bf9c9ba619df6c15befba8cea695b6e7df1ce7a8b843d304eecc71248e2c858

General

Target

97e46ad2eed9f3079baaeb4d0f7f476b.exe
Size

771KB
MD5

97e46ad2eed9f3079baaeb4d0f7f476b
SHA1

014680bbbbefd977b50002233af54ab07d4846af
SHA256

6bf9c9ba619df6c15befba8cea695b6e7df1ce7a8b843d304eecc71248e2c858
SHA512

8003fb326212fc129981d6e463fd9fe6e6a45ba3e53b66d561b810d875a6347b366a010823b59b0a52f88a046d2dbd5bccb125e21c7f3ea8a6c37b0e0cd1db4b
SSDEEP

12288:GJ3/IV44aRFPdUURBsOolngTTX3hAOpSXWZL4YfZZG+ECaBwQ2tb5JLrnyl0:GdpRFFUpXlWTHhAPqL4Yyt1B+5vM0

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Loads dropped DLL 1 IoCs

pid	Process
1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
7	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe
2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2204	1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe	28
PID 1260 wrote to memory of 2204	1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe	28
PID 1260 wrote to memory of 2204	1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe	28
PID 1260 wrote to memory of 2204	1260	97e46ad2eed9f3079baaeb4d0f7f476b.exe	28
PID 2204 wrote to memory of 2388	2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe	29
PID 2204 wrote to memory of 2388	2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe	29
PID 2204 wrote to memory of 2388	2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe	29
PID 2204 wrote to memory of 2388	2204	97e46ad2eed9f3079baaeb4d0f7f476b.exe	29

C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe
"C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe
  C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe

Filesize
771KB

MD5
1b3b514c8bd3029369376b95fc415138

SHA1
3bf28c432ac1f010963c350952bdca0792101fd0

SHA256
6bbc7d73848bcb335a8e4ac376553380513b053b1ec108a73f2447323748e909

SHA512
9e1b58565777d76286e3a91d54cc509d1a3a3c09ce6e39f829e5a06ddd5c9e6fc6fb120ea18732fd87e8ce1a09808e9b9c71287380885ef21c2161d0b80d400a

Download Submit
C:\Users\Admin\AppData\Local\Temp\97e46ad2eed9f3079baaeb4d0f7f476b.exe

Filesize
640KB

MD5
be05660fabe710500eac307fea01b650

SHA1
bf0cc7dec2b498863cb85cf166dcdb0cf1373765

SHA256
0c77c64f41bc7e8331ff6c6cd266496b872d89fce97efa442f233013dcdc4724

SHA512
26c458f1fbc22e01098f4e0a9248272d2ee06659d151599be90640e41bbf5d08fbe877ca3fce98a07be407be3dfab72a2e8e6611d7b0024e53057cfbb80ca203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab586E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar590D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1260-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1260-3-0x0000000000350000-0x00000000003D3000-memory.dmp

Filesize
524KB

Download
memory/1260-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1260-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1260-15-0x0000000002CE0000-0x0000000002D63000-memory.dmp

Filesize
524KB

Download
memory/2204-17-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2204-28-0x0000000002D90000-0x0000000002E0E000-memory.dmp

Filesize
504KB

Download
memory/2204-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2204-19-0x0000000000370000-0x00000000003F3000-memory.dmp

Filesize
524KB

Download
memory/2204-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads