a9f1687663f42e1642217e53483184f2204ae1b57da7ec682dbf0a9bcb7622d9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8438756f82f3b5c123a8fa9b0bb8406.exe
Size

506KB
MD5

b8438756f82f3b5c123a8fa9b0bb8406
SHA1

9b19341767887f49d1e6d8f526a8ee773751c4de
SHA256

a9f1687663f42e1642217e53483184f2204ae1b57da7ec682dbf0a9bcb7622d9
SHA512

3eb932c848f89ee24b64bb357baebe7bdf86bfef33cb15a45d222032bba94aed5bc46f2de45941f77507d778891098ff313aeb0aa67bed869d12863002d2ae5f
SSDEEP

12288:5ZLYvmkopWAS2ydZ1QSg94AKGWzg1hdLVeHtct:5ZLGohS7QSSjIU3dLcNct

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe

Executes dropped EXE 1 IoCs

pid	Process
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	pastebin.com
23	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4816	b8438756f82f3b5c123a8fa9b0bb8406.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4816	b8438756f82f3b5c123a8fa9b0bb8406.exe
4212	b8438756f82f3b5c123a8fa9b0bb8406.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4212	4816	b8438756f82f3b5c123a8fa9b0bb8406.exe	88
PID 4816 wrote to memory of 4212	4816	b8438756f82f3b5c123a8fa9b0bb8406.exe	88
PID 4816 wrote to memory of 4212	4816	b8438756f82f3b5c123a8fa9b0bb8406.exe	88
PID 4212 wrote to memory of 3864	4212	b8438756f82f3b5c123a8fa9b0bb8406.exe	91
PID 4212 wrote to memory of 3864	4212	b8438756f82f3b5c123a8fa9b0bb8406.exe	91
PID 4212 wrote to memory of 3864	4212	b8438756f82f3b5c123a8fa9b0bb8406.exe	91

C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe
"C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe
  C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe

Filesize
506KB

MD5
2fd4a061042378ecb33d1b30ecb0aea1

SHA1
a20b49a2d7d8cb6a71972800f8e018e7ba94ea67

SHA256
883baa84503a2018546bd26c84a87531b67ee006d9b37e1b5f7b7380dbaa1238

SHA512
8adedd59d609fcb12e08b1d3f4bb07e32a3187cb9ae24adf6d147c0715fe4324dfa8636ba7a30bc7619740a349b9e45cafb2c9d5d91522a58e6edc5144d7f670

Download Submit
memory/4212-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4212-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4212-20-0x0000000001650000-0x00000000016CE000-memory.dmp

Filesize
504KB

Download
memory/4212-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4212-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4816-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4816-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4816-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4816-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download