1dd8c0563b6c40393f91e6bda4a0ef30658cf26dfbc666017dce0d18c4f77ce5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b6f7965965eb99e2e4b0b64636aecccd.exe
Size

242KB
MD5

b6f7965965eb99e2e4b0b64636aecccd
SHA1

a20fa547b6be2fea0a45f59c0a798c396ef1729a
SHA256

1dd8c0563b6c40393f91e6bda4a0ef30658cf26dfbc666017dce0d18c4f77ce5
SHA512

04085cc20698046a9142191b09ad2fc6707e038a985b365607a306968bd062153123caff84b2549e1e9de10111de99147e5313f346214ea6b26e9a0583d477f2
SSDEEP

6144:YVYbgig3k6EbSmkHLvxK6LIbM39+R2QvOq4JWNypcVm:YGb9MEbpkrJ/vSWMzm

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1856	b6f7965965eb99e2e4b0b64636aecccd.exe

Executes dropped EXE 1 IoCs

pid	Process
1856	b6f7965965eb99e2e4b0b64636aecccd.exe

Loads dropped DLL 1 IoCs

pid	Process
2344	b6f7965965eb99e2e4b0b64636aecccd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1856	b6f7965965eb99e2e4b0b64636aecccd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1856	b6f7965965eb99e2e4b0b64636aecccd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2344	b6f7965965eb99e2e4b0b64636aecccd.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2344	b6f7965965eb99e2e4b0b64636aecccd.exe
1856	b6f7965965eb99e2e4b0b64636aecccd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1856	2344	b6f7965965eb99e2e4b0b64636aecccd.exe	28
PID 2344 wrote to memory of 1856	2344	b6f7965965eb99e2e4b0b64636aecccd.exe	28
PID 2344 wrote to memory of 1856	2344	b6f7965965eb99e2e4b0b64636aecccd.exe	28
PID 2344 wrote to memory of 1856	2344	b6f7965965eb99e2e4b0b64636aecccd.exe	28
PID 1856 wrote to memory of 2572	1856	b6f7965965eb99e2e4b0b64636aecccd.exe	29
PID 1856 wrote to memory of 2572	1856	b6f7965965eb99e2e4b0b64636aecccd.exe	29
PID 1856 wrote to memory of 2572	1856	b6f7965965eb99e2e4b0b64636aecccd.exe	29
PID 1856 wrote to memory of 2572	1856	b6f7965965eb99e2e4b0b64636aecccd.exe	29

C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe
"C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe
  C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b6f7965965eb99e2e4b0b64636aecccd.exe

Filesize
242KB

MD5
6227344bbf4e7be263b1eba69b6697bb

SHA1
b4843feb20b63d2a801bd84d884584e981109d0f

SHA256
f85340d0d4438cf0ab655d02deed42fb13156a38e23608a10121f957f4f7091c

SHA512
33f116211cb984e91a17fbb59ac87383a9e16f278b8b9fcff0cdee6cdc71b60e640ccf1b8da76a2de7cbf280070e4fa255fec0a26cb0a8f536c7d3ba8e0e52d6

Download Submit
memory/1856-20-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1856-21-0x00000000014C0000-0x0000000001577000-memory.dmp

Filesize
732KB

Download
memory/1856-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1856-24-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1856-25-0x0000000002D10000-0x0000000002D77000-memory.dmp

Filesize
412KB

Download
memory/2344-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2344-2-0x00000000002B0000-0x0000000000367000-memory.dmp

Filesize
732KB

Download
memory/2344-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2344-14-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2344-17-0x0000000002EB0000-0x0000000002F67000-memory.dmp

Filesize
732KB

Download