fd08565cfb3211e79d658c38c549eb9dad3f39c8b2dfcc7223700ae8675b7578

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c57a4d50c828ce8f085b1b0de7c94f6d.exe
Size

1000KB
MD5

c57a4d50c828ce8f085b1b0de7c94f6d
SHA1

c439e4241fd2869f20102a3920bb2789cec04fb9
SHA256

fd08565cfb3211e79d658c38c549eb9dad3f39c8b2dfcc7223700ae8675b7578
SHA512

bd0e82f6368f00a2430a49a918f6946f06030df3b026194a2b47581aa314f47a7caa012db3812f45e41ddb92fe2fe9d92790c1d599c6156fba4ec83d4063925c
SSDEEP

12288:oYXhS9D5etdp3nXYZ53pHqUQIHPNOBs3ECaBwQ2tb5JLrnylUPqt0gHDS7eyod:oYsDcr1SfqDY4x1B+5vMiqt0gj2ed

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	pastebin.com
35	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2652	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2652	c57a4d50c828ce8f085b1b0de7c94f6d.exe
4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4892	2652	c57a4d50c828ce8f085b1b0de7c94f6d.exe	87
PID 2652 wrote to memory of 4892	2652	c57a4d50c828ce8f085b1b0de7c94f6d.exe	87
PID 2652 wrote to memory of 4892	2652	c57a4d50c828ce8f085b1b0de7c94f6d.exe	87
PID 4892 wrote to memory of 552	4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe	91
PID 4892 wrote to memory of 552	4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe	91
PID 4892 wrote to memory of 552	4892	c57a4d50c828ce8f085b1b0de7c94f6d.exe	91

C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe
"C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe
  C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c57a4d50c828ce8f085b1b0de7c94f6d.exe

Filesize
1000KB

MD5
84b71bff0950c509e6d230b5635391c7

SHA1
b44d3bd3d656f7235b28a15be7bc20a365270523

SHA256
f88aaedf5f11449cf2706a2fd7aa7099444fdfb55573950fae1612c6ff92030a

SHA512
690b49fd55d1855e253b0e21fc24a0409f21fbfd65e5ace8c4d1770c9d8b2252e679722e796445e968291d8dfa2a3546af413566125e6144e1a04e2cce63f846

Download Submit
memory/2652-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2652-1-0x0000000000160000-0x00000000001E3000-memory.dmp

Filesize
524KB

Download
memory/2652-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2652-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4892-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4892-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4892-20-0x0000000004FC0000-0x000000000503E000-memory.dmp

Filesize
504KB

Download
memory/4892-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4892-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download