9433ecca54769567514e43138c76d2b437369e057d3a39a1533c0bca5fa0d557

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d8f7cd468da90f9441ffc02f72e39d.exe
Size

1000KB
MD5

c8d8f7cd468da90f9441ffc02f72e39d
SHA1

0a4f6543d35c32b149ab4addac208a29518c1ccb
SHA256

9433ecca54769567514e43138c76d2b437369e057d3a39a1533c0bca5fa0d557
SHA512

8843b938ee6c813f04283b0fe54478a763b6aab84a06d260f92b82988aa08b700078a9e91f55bfddccd4698c0a2fd12d09ee87bbda8b78f5910151a731eb30ad
SSDEEP

24576:RDxEoQb29UTbiyRKJ222Qtm89J41B+5vMiqt0gj2ed:53QS9UTe0S92JqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
448	c8d8f7cd468da90f9441ffc02f72e39d.exe

Executes dropped EXE 1 IoCs

pid	Process
448	c8d8f7cd468da90f9441ffc02f72e39d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
34	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
448	c8d8f7cd468da90f9441ffc02f72e39d.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
448	c8d8f7cd468da90f9441ffc02f72e39d.exe
448	c8d8f7cd468da90f9441ffc02f72e39d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3644	c8d8f7cd468da90f9441ffc02f72e39d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3644	c8d8f7cd468da90f9441ffc02f72e39d.exe
448	c8d8f7cd468da90f9441ffc02f72e39d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 448	3644	c8d8f7cd468da90f9441ffc02f72e39d.exe	91
PID 3644 wrote to memory of 448	3644	c8d8f7cd468da90f9441ffc02f72e39d.exe	91
PID 3644 wrote to memory of 448	3644	c8d8f7cd468da90f9441ffc02f72e39d.exe	91
PID 448 wrote to memory of 2016	448	c8d8f7cd468da90f9441ffc02f72e39d.exe	93
PID 448 wrote to memory of 2016	448	c8d8f7cd468da90f9441ffc02f72e39d.exe	93
PID 448 wrote to memory of 2016	448	c8d8f7cd468da90f9441ffc02f72e39d.exe	93

C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe
"C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe
  C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c8d8f7cd468da90f9441ffc02f72e39d.exe

Filesize
1000KB

MD5
8458b31b6f721db69e3ef2a552a214f6

SHA1
2cfe0eebbdd1e18c2cc5ee5588e2c9406c2719f6

SHA256
802fedad556e4d3aeb8dd64da35e3cdea0edd6c3853ae1d029b874c4330d4475

SHA512
696687367e5059ad5c8fc640c97e0a45184dec1dd51e770283a9661d48d3fc1207abf5b1eff846a32abc68e94714967cde3e2595ad25c563680330c8d8a71640

Download Submit
memory/448-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/448-15-0x0000000001640000-0x00000000016C3000-memory.dmp

Filesize
524KB

Download
memory/448-20-0x0000000004FA0000-0x000000000501E000-memory.dmp

Filesize
504KB

Download
memory/448-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/448-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3644-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3644-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3644-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3644-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download