34dcc97dbdc3bec1ff7e4b0405b6b34c23ebce48d769e363577632c9b98f394d

Analysis

max time kernel
160s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beff46b1dd6ef3d294c4d64a11c94306.exe
Size

1000KB
MD5

beff46b1dd6ef3d294c4d64a11c94306
SHA1

6cad753658b716c9847af44cc18cfc98ff03d944
SHA256

34dcc97dbdc3bec1ff7e4b0405b6b34c23ebce48d769e363577632c9b98f394d
SHA512

31d5e4cba0ffa4341f8b0b547aefbc3cff72a8c08ca0cbf6a2821c1f4c0c4b8eb24d97a1df140fc4e2fa5a9d2f3967b75f9ccd64c6f1090f8354d8f66afd810a
SSDEEP

24576:Df0G9psLIcLHhHwjQy1B+5vMiqt0gj2ed:jaHwjQYqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3840	beff46b1dd6ef3d294c4d64a11c94306.exe

Executes dropped EXE 1 IoCs

pid	Process
3840	beff46b1dd6ef3d294c4d64a11c94306.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
19	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3840	beff46b1dd6ef3d294c4d64a11c94306.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3840	beff46b1dd6ef3d294c4d64a11c94306.exe
3840	beff46b1dd6ef3d294c4d64a11c94306.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1716	beff46b1dd6ef3d294c4d64a11c94306.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1716	beff46b1dd6ef3d294c4d64a11c94306.exe
3840	beff46b1dd6ef3d294c4d64a11c94306.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3840	1716	beff46b1dd6ef3d294c4d64a11c94306.exe	88
PID 1716 wrote to memory of 3840	1716	beff46b1dd6ef3d294c4d64a11c94306.exe	88
PID 1716 wrote to memory of 3840	1716	beff46b1dd6ef3d294c4d64a11c94306.exe	88
PID 3840 wrote to memory of 648	3840	beff46b1dd6ef3d294c4d64a11c94306.exe	91
PID 3840 wrote to memory of 648	3840	beff46b1dd6ef3d294c4d64a11c94306.exe	91
PID 3840 wrote to memory of 648	3840	beff46b1dd6ef3d294c4d64a11c94306.exe	91

C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe
"C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe
  C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\beff46b1dd6ef3d294c4d64a11c94306.exe

Filesize
1000KB

MD5
194a6fad8d0e490977c0e0959ca62808

SHA1
cc9fd2be00fdf3d915804e1f07e5c7c4d341dae6

SHA256
fdc099ac384ffefc6466bd6c7665a2f00643cf28ef4b794c49e6308d577ee049

SHA512
a371f19d2228d614d8520866235ef9bf7f3651e4a22c283a6b950ff17b211112c7bb5575e63095d761e9c5313ae952e19fda8fd51ac283cda3197e1b01c2db6b

Download Submit
memory/1716-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1716-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1716-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1716-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3840-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3840-14-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3840-20-0x0000000001670000-0x00000000016EE000-memory.dmp

Filesize
504KB

Download
memory/3840-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3840-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download