4fd2f26df9d5f0fdde23e6d95b335fd7ce13f7ccb609d596f06047d9520956c3

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad7b7a3222f052bfd8ed7954104f06c.exe
Size

506KB
MD5

bad7b7a3222f052bfd8ed7954104f06c
SHA1

d5f4f24607fcbb259dcfe210f1da5129ace7d26d
SHA256

4fd2f26df9d5f0fdde23e6d95b335fd7ce13f7ccb609d596f06047d9520956c3
SHA512

c5962bfa93868d733a2992c5d5161c2bf56d9ffeacdf99cff5d61097d1cc5421996e84b71a443e67427f589a06aa991ec367d9b0a9cd19a90703c52d648cfda1
SSDEEP

12288:Pny1ndrmU1swNl+s/dIJt4yW1x3niTREbvoAwGLL2q0b:PytRmUpl7VIP4yWTgEbhx70b

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4016	bad7b7a3222f052bfd8ed7954104f06c.exe

Executes dropped EXE 1 IoCs

pid	Process
4016	bad7b7a3222f052bfd8ed7954104f06c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
24	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4016	bad7b7a3222f052bfd8ed7954104f06c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4016	bad7b7a3222f052bfd8ed7954104f06c.exe
4016	bad7b7a3222f052bfd8ed7954104f06c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4956	bad7b7a3222f052bfd8ed7954104f06c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4956	bad7b7a3222f052bfd8ed7954104f06c.exe
4016	bad7b7a3222f052bfd8ed7954104f06c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4016	4956	bad7b7a3222f052bfd8ed7954104f06c.exe	88
PID 4956 wrote to memory of 4016	4956	bad7b7a3222f052bfd8ed7954104f06c.exe	88
PID 4956 wrote to memory of 4016	4956	bad7b7a3222f052bfd8ed7954104f06c.exe	88
PID 4016 wrote to memory of 4916	4016	bad7b7a3222f052bfd8ed7954104f06c.exe	91
PID 4016 wrote to memory of 4916	4016	bad7b7a3222f052bfd8ed7954104f06c.exe	91
PID 4016 wrote to memory of 4916	4016	bad7b7a3222f052bfd8ed7954104f06c.exe	91

C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe
"C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe
  C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe

Filesize
506KB

MD5
cdad864f93a6ff11893e6042cccc8151

SHA1
7eebd06642dc173c98f16fcbfa94434684a88ef5

SHA256
96a6cd5e941001b12c0136318b844fd9feef9a8da9e92591560c3f28ca22fe96

SHA512
a38ea57d951328c45a7f96c8e40cb070de0c48b64dad8de211ad79d1ee369f3f594f4a6de37cc3deb0aa9039f1e4ce5cf6c5debc8f144b797e9353a9af06bad6

Download Submit
memory/4016-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4016-15-0x0000000000170000-0x00000000001F3000-memory.dmp

Filesize
524KB

Download
memory/4016-20-0x0000000004FC0000-0x000000000503E000-memory.dmp

Filesize
504KB

Download
memory/4016-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4016-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4956-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4956-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4956-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4956-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download