ce3fae98c6650777586f1e2cbfccdb2f47bd5065426f6f1ce5d49dbba80989d2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67548d19dd4ce6bfb52a8199efa839e.exe
Size

1000KB
MD5

b67548d19dd4ce6bfb52a8199efa839e
SHA1

2d8bf760987424201c605fa7efa55cc99ceaf72f
SHA256

ce3fae98c6650777586f1e2cbfccdb2f47bd5065426f6f1ce5d49dbba80989d2
SHA512

91addcc457283095c044c7891cf76fb6f03e98289de9aacb8b7615b1185644d0072ed023c45c47bf5585cb9e7e7e2e4c44431b6fd7b7efea2fc7d7926d59533a
SSDEEP

24576:INAUT69IKeDZC5VdoV1B+5vMiqt0gj2ed:InuetgQqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4516	b67548d19dd4ce6bfb52a8199efa839e.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	b67548d19dd4ce6bfb52a8199efa839e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	pastebin.com
32	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4516	b67548d19dd4ce6bfb52a8199efa839e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	b67548d19dd4ce6bfb52a8199efa839e.exe
4516	b67548d19dd4ce6bfb52a8199efa839e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3092	b67548d19dd4ce6bfb52a8199efa839e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3092	b67548d19dd4ce6bfb52a8199efa839e.exe
4516	b67548d19dd4ce6bfb52a8199efa839e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4516	3092	b67548d19dd4ce6bfb52a8199efa839e.exe	88
PID 3092 wrote to memory of 4516	3092	b67548d19dd4ce6bfb52a8199efa839e.exe	88
PID 3092 wrote to memory of 4516	3092	b67548d19dd4ce6bfb52a8199efa839e.exe	88
PID 4516 wrote to memory of 1160	4516	b67548d19dd4ce6bfb52a8199efa839e.exe	92
PID 4516 wrote to memory of 1160	4516	b67548d19dd4ce6bfb52a8199efa839e.exe	92
PID 4516 wrote to memory of 1160	4516	b67548d19dd4ce6bfb52a8199efa839e.exe	92

C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe
"C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe
  C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b67548d19dd4ce6bfb52a8199efa839e.exe

Filesize
1000KB

MD5
b7fd58266d1e953614c34ec49f3b7fc2

SHA1
b9b2c341addd98e5705d29d130f45849bdfa6376

SHA256
7f5355dd0ef421d25c197ec6bbc96da3c7ff2741eaf1d70401eaced257af3c89

SHA512
8a1e4d25cbb50fb861af720cd4ae7208798e60c6797206983b6cabff9de3f8f8a29139a8f870b4d91e824e35a47cc25550763c2ba165ac781fa8117d5615c3b4

Download Submit
memory/3092-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3092-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3092-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3092-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4516-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4516-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4516-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/4516-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4516-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download