1b48935797dc116039c692264b698946a25493925bc41770e2ea70e20cbd1977

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c566a21c99d22927a8985948ec0edd1e.exe
Size

1000KB
MD5

c566a21c99d22927a8985948ec0edd1e
SHA1

00f6947caa2bfaf9b61194d96928444472af4b59
SHA256

1b48935797dc116039c692264b698946a25493925bc41770e2ea70e20cbd1977
SHA512

3c823b9d45dca95a0271709ff1a06e307017f35d484ee100487abece5dbbbefd28d3b0f1f34f8a28261993fd273d0f7663017e3dc66f4f5ead40755bc471dc59
SSDEEP

24576:FaUYS1a4pnKxeVqb6ZtmB2W7H1B+5vMiqt0gj2ed:Ft1aKKxeVqb6ZtkjqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2216	c566a21c99d22927a8985948ec0edd1e.exe

Executes dropped EXE 1 IoCs

pid	Process
2216	c566a21c99d22927a8985948ec0edd1e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	pastebin.com
35	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2216	c566a21c99d22927a8985948ec0edd1e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	c566a21c99d22927a8985948ec0edd1e.exe
2216	c566a21c99d22927a8985948ec0edd1e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1148	c566a21c99d22927a8985948ec0edd1e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1148	c566a21c99d22927a8985948ec0edd1e.exe
2216	c566a21c99d22927a8985948ec0edd1e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2216	1148	c566a21c99d22927a8985948ec0edd1e.exe	89
PID 1148 wrote to memory of 2216	1148	c566a21c99d22927a8985948ec0edd1e.exe	89
PID 1148 wrote to memory of 2216	1148	c566a21c99d22927a8985948ec0edd1e.exe	89
PID 2216 wrote to memory of 3992	2216	c566a21c99d22927a8985948ec0edd1e.exe	92
PID 2216 wrote to memory of 3992	2216	c566a21c99d22927a8985948ec0edd1e.exe	92
PID 2216 wrote to memory of 3992	2216	c566a21c99d22927a8985948ec0edd1e.exe	92

C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe
"C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe
  C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c566a21c99d22927a8985948ec0edd1e.exe

Filesize
1000KB

MD5
8c4fc8df67869a092d1079eba0de229e

SHA1
62807c84471f28a37483144c711564a398d1b9b7

SHA256
adb5e8a9ddf63f7cc61d933a0a6e56108dec9196f5df6705a9e25cfc927ba5ba

SHA512
e7f98379964c2e5bbac7dab2fa1f2b62bad759c0a37f4f183bbaccca425592c821a3426437b88230ba5e6d10ed7365fdf2ac4c5865a9437bbd4301c3fb38c686

Download Submit
memory/1148-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1148-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/1148-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1148-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2216-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2216-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/2216-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2216-20-0x0000000001690000-0x000000000170E000-memory.dmp

Filesize
504KB

Download
memory/2216-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download