c2decdaedf97bee1e8d9d9c7156d9bb92a1941850661701b8907e87078997c3e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b94e7c5ecb3fcc1540d6bf98f796531b.exe
Size 506KB
Sample240307-we15fsac4t
SHA256 c2decdaedf97bee1e8d9d9c7156d9bb92a1941850661701b8907e87078997c3e
MD5 b94e7c5ecb3fcc1540d6bf98f796531b
SHA1 95f3f0237088b7eb50f63a25bebc7b05eefb7f06
SHA512 ecc9965ae3fcaf39bd556dfd5e8c083b0d6b72da745cbde07e7f68ecfe8d63c8d9c585151a4ecc4ef0b00569cbcd7a679bae9823045b30ec7640369f13c93fb1
SSDEEP 12288:+jAkKZ6RNW1JsMhpCPXdgmr/XTet0WLVVfkOvJ/RaWTRa:2dW1qMpU2qeHVfkOB/lTs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Executes dropped EXE 1 IoCs

pid	Process
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	pastebin.com
20	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1628	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1628	b94e7c5ecb3fcc1540d6bf98f796531b.exe
1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1468	1628	b94e7c5ecb3fcc1540d6bf98f796531b.exe	88
PID 1628 wrote to memory of 1468	1628	b94e7c5ecb3fcc1540d6bf98f796531b.exe	88
PID 1628 wrote to memory of 1468	1628	b94e7c5ecb3fcc1540d6bf98f796531b.exe	88
PID 1468 wrote to memory of 2940	1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe	92
PID 1468 wrote to memory of 2940	1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe	92
PID 1468 wrote to memory of 2940	1468	b94e7c5ecb3fcc1540d6bf98f796531b.exe	92

C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe
"C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe
  C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b94e7c5ecb3fcc1540d6bf98f796531b.exe

Path C:\Users\Admin\AppData\Local\Temp\b94e7c5ecb3fcc1540d6bf98f796531b.exe
Size 386KB
SHA256 c80fb5283928bee1b0e54561878d39212754964d021b5b2eb7bf97ef74593b2d
MD5 ff8ee19567226eed8cd2677746ee4cdb
SHA1 7fe3fac7d2544aba118b1029f47fa0fec89a6871
SHA512 f5cbb8762f9d87f9b24e1903a7c02a3c4cd2a86017f92956c9ae9a17e601c92e281daacf56e0773f606f0ad1e89adfc558e19def7bc54bb382c1d85621a8dfa5
SSDEEP 12288:UTeS88bpxdRWglRiHqaCxBPJGMJ2I2ykloiR:UTXJbpEgn6ykfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-13-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1468-20-0x0000000004F80000-0x0000000004FFE000-memory.dmp

Download

memory/1468-19-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1468-26-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1628-0-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1628-2-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1628-1-0x0000000001610000-0x0000000001693000-memory.dmp

Download

memory/1628-11-0x0000000000400000-0x000000000047E000-memory.dmp

Download