Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 17:18

General

  • Target

    bc5ec041f77b4e78ea39b2b5476f4a88.exe

  • Size

    483KB

  • MD5

    bc5ec041f77b4e78ea39b2b5476f4a88

  • SHA1

    5a47d47fe55603f26847a8f7ba4182248f215fba

  • SHA256

    a30b3f060dc69295c6fb8da9bd75c29c6184c8a1658d1c7b8a90d4b23fe22617

  • SHA512

    38e38543611084996f70e409fcbbf88af239d709d8e88c5c8556f26c5288ca445478ae36d8a34a63d2a6f12b07889368f5820d6696f4b81bfbb206cd95bc10c9

  • SSDEEP

    12288:CcCbykb/LMgQOCE2N6Ihliq7ewBOvo4IWYyic2IL/Vi:6AjtE2Nt7e4JjWZfL/E

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe
    "C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe
      C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:5096
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bc5ec041f77b4e78ea39b2b5476f4a88.exe

      Filesize

      483KB

      MD5

      5550bd934a24c8dc1372dc342393d59d

      SHA1

      8f0a670e43353ad18d38d3043e0729aea11050b8

      SHA256

      dcaef06f80d51196456c77f1b0feccdfdded33add704d51f2531205723cae348

      SHA512

      6b463f15ff0c15b1faf882b2679fabecb712399ce9133da89d1f0a7376ab80bded2ae1c518292bdfc566f0e437d8ed6b17efff4a665acab6c341be5e9fb69df8

    • memory/1292-13-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/1292-14-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

    • memory/1292-15-0x00000000014C0000-0x0000000001577000-memory.dmp

      Filesize

      732KB

    • memory/1292-20-0x0000000001680000-0x00000000016E6000-memory.dmp

      Filesize

      408KB

    • memory/1292-21-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3600-0-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/3600-1-0x0000000001600000-0x00000000016B7000-memory.dmp

      Filesize

      732KB

    • memory/3600-2-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

    • memory/3600-11-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB