36f3e618c717c07f9a500fe458d9359b8e6c5e3fc28bd18addf6b57ea1587dd7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca492611ab7e9562d4d99487411165a5.exe
Size

506KB
MD5

ca492611ab7e9562d4d99487411165a5
SHA1

007d4124cfbceba40dbc5989afecda7fafcb8615
SHA256

36f3e618c717c07f9a500fe458d9359b8e6c5e3fc28bd18addf6b57ea1587dd7
SHA512

286d682f13743980c3e9c8f8b8703063f051bc857bcac892f9308b299b44a2fcbe00ad172a3d73c9cbe223aca82e4e3aa5a528114e80a3c54b3c12538571cd55
SSDEEP

12288:SfxmA0l7EJ+fRjScj/nwa8zvOUUfg2rN9qAeFQjr:9wMjvwHzfUfzrtLjr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4208	ca492611ab7e9562d4d99487411165a5.exe

Executes dropped EXE 1 IoCs

pid	Process
4208	ca492611ab7e9562d4d99487411165a5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
18	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4208	ca492611ab7e9562d4d99487411165a5.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4208	ca492611ab7e9562d4d99487411165a5.exe
4208	ca492611ab7e9562d4d99487411165a5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3016	ca492611ab7e9562d4d99487411165a5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3016	ca492611ab7e9562d4d99487411165a5.exe
4208	ca492611ab7e9562d4d99487411165a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4208	3016	ca492611ab7e9562d4d99487411165a5.exe	88
PID 3016 wrote to memory of 4208	3016	ca492611ab7e9562d4d99487411165a5.exe	88
PID 3016 wrote to memory of 4208	3016	ca492611ab7e9562d4d99487411165a5.exe	88
PID 4208 wrote to memory of 2068	4208	ca492611ab7e9562d4d99487411165a5.exe	91
PID 4208 wrote to memory of 2068	4208	ca492611ab7e9562d4d99487411165a5.exe	91
PID 4208 wrote to memory of 2068	4208	ca492611ab7e9562d4d99487411165a5.exe	91

C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe
"C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe
  C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ca492611ab7e9562d4d99487411165a5.exe

Filesize
506KB

MD5
c21bbe18a5780a464de1e511d80a5260

SHA1
dbd039915eeb7c2ad9d5042a15ef47960f7a9e71

SHA256
61fd0c4ff1d17170ed2f6addd80af47359a588a75866769c714a9917d8fc4ffd

SHA512
5ca0d0795804ceca5ece856b28e1a11608fe6f7da2bfc813b28b75b1aa6bcbd738f53aae6ffa88950bc41a4ba892fcb5d198e0e0ef15ebeca522e85d569f6d2d

Download Submit
memory/3016-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3016-1-0x0000000001670000-0x00000000016F3000-memory.dmp

Filesize
524KB

Download
memory/3016-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3016-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4208-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4208-16-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/4208-21-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/4208-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4208-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download