404420d23348b4f6163d409ed2381056c6319e9f492b9a4a5b0f6b28a132ee0a

Analysis

max time kernel
95s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc40855c45c364e9b87b5f15635c9ad7.exe
Size

1000KB
MD5

cc40855c45c364e9b87b5f15635c9ad7
SHA1

e78e5724170a8d1a160f2734f3d68d4312f14ee2
SHA256

404420d23348b4f6163d409ed2381056c6319e9f492b9a4a5b0f6b28a132ee0a
SHA512

d0cf05bba23750d4d3dc365d7e87a30ee390556069d11225f29e466e4db46d64f3976964ea7fe03ff57f8e3014184b7cfef0bfb3bef70f4ce4a9a2e49ad50782
SSDEEP

24576:aNd2/xq6VecWfa5sHGdqRDoeY7d15ipq1B+5vMiqt0gj2ed:aY/xq64Vfa5sHGdqRDoeY7dvipgqOL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
368	cc40855c45c364e9b87b5f15635c9ad7.exe

Executes dropped EXE 1 IoCs

pid	Process
368	cc40855c45c364e9b87b5f15635c9ad7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
20	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
368	cc40855c45c364e9b87b5f15635c9ad7.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
368	cc40855c45c364e9b87b5f15635c9ad7.exe
368	cc40855c45c364e9b87b5f15635c9ad7.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5068	cc40855c45c364e9b87b5f15635c9ad7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5068	cc40855c45c364e9b87b5f15635c9ad7.exe
368	cc40855c45c364e9b87b5f15635c9ad7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 368	5068	cc40855c45c364e9b87b5f15635c9ad7.exe	85
PID 5068 wrote to memory of 368	5068	cc40855c45c364e9b87b5f15635c9ad7.exe	85
PID 5068 wrote to memory of 368	5068	cc40855c45c364e9b87b5f15635c9ad7.exe	85
PID 368 wrote to memory of 3688	368	cc40855c45c364e9b87b5f15635c9ad7.exe	86
PID 368 wrote to memory of 3688	368	cc40855c45c364e9b87b5f15635c9ad7.exe	86
PID 368 wrote to memory of 3688	368	cc40855c45c364e9b87b5f15635c9ad7.exe	86

C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe
"C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe
  C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe

Filesize
1000KB

MD5
0ea73b9884c6bc49b92d8af33e52138c

SHA1
ba7c66550ac0e9b7741c762cfe95a896fc13fbc4

SHA256
2a11bf1bf955360a1c9affb078804d272a2c663aaa54d74cc4bfb246e61d859b

SHA512
089d317153f7bddd281b65404065fd15d030af22162cefa339a8c983606062b9abac49b40440f483eaf839d348aa2c7cda14e99ce56d82ea75c54de40bb5f000

Download Submit
memory/368-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/368-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/368-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

Filesize
504KB

Download
memory/368-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/368-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5068-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/5068-1-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/5068-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5068-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download