ade7fa0b646459ebf7b863d4ff58970f60cf40434fa05932713fb85dc13eb049

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb7b963071ef3e6d3abb74078ef964b7.exe
Size

1000KB
MD5

bb7b963071ef3e6d3abb74078ef964b7
SHA1

73b05b38ff0ce1dbe7537b899e868833c12799df
SHA256

ade7fa0b646459ebf7b863d4ff58970f60cf40434fa05932713fb85dc13eb049
SHA512

77a1a45284d5035c01bed02b899802dcb4f5894e7b57e0f1385d708aa7c6230da512136cf2e9d15a2360e7dc4bf6938cdf67a2365949a14e2e24e53de3852ef0
SSDEEP

24576:yQTIlI1cAKUvJ6sZokKBx/wCtli1B+5vMiqt0gj2ed:Ql+PKYBorIqCqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3436	bb7b963071ef3e6d3abb74078ef964b7.exe

Executes dropped EXE 1 IoCs

pid	Process
3436	bb7b963071ef3e6d3abb74078ef964b7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
46	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3436	bb7b963071ef3e6d3abb74078ef964b7.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	bb7b963071ef3e6d3abb74078ef964b7.exe
3436	bb7b963071ef3e6d3abb74078ef964b7.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3272	bb7b963071ef3e6d3abb74078ef964b7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3272	bb7b963071ef3e6d3abb74078ef964b7.exe
3436	bb7b963071ef3e6d3abb74078ef964b7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 3436	3272	bb7b963071ef3e6d3abb74078ef964b7.exe	89
PID 3272 wrote to memory of 3436	3272	bb7b963071ef3e6d3abb74078ef964b7.exe	89
PID 3272 wrote to memory of 3436	3272	bb7b963071ef3e6d3abb74078ef964b7.exe	89
PID 3436 wrote to memory of 4468	3436	bb7b963071ef3e6d3abb74078ef964b7.exe	93
PID 3436 wrote to memory of 4468	3436	bb7b963071ef3e6d3abb74078ef964b7.exe	93
PID 3436 wrote to memory of 4468	3436	bb7b963071ef3e6d3abb74078ef964b7.exe	93

C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe
"C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe
  C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bb7b963071ef3e6d3abb74078ef964b7.exe

Filesize
1000KB

MD5
e861563bfc29b7202a102d5847bfe5d9

SHA1
f205dec42c4b59e0dde4584f7acc695a925a7f22

SHA256
273163f65663d2547aea87c078913942bd8d6bcd08eabf65c77b857d8b088c21

SHA512
2a26ef11977a2a3de4676781ce851838f3138543df168b450967066925c2dcfd56d87907c527a436e9e601d0114c26e0f44491e8a1eecbe23e2df67afa619e4d

Download Submit
memory/3272-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3272-1-0x0000000001490000-0x0000000001513000-memory.dmp

Filesize
524KB

Download
memory/3272-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3272-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3436-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3436-17-0x0000000000160000-0x00000000001E3000-memory.dmp

Filesize
524KB

Download
memory/3436-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3436-21-0x0000000004EE0000-0x0000000004F5E000-memory.dmp

Filesize
504KB

Download
memory/3436-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download