4e19a40730603f320791276e223bff078d6a0102f8e57a14a9cfa8a4c071221f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d650789d2908031fe4eaf486fb62c554.exe
Size

506KB
MD5

d650789d2908031fe4eaf486fb62c554
SHA1

ab9c8204032550f569253ee436bde20cd1714da2
SHA256

4e19a40730603f320791276e223bff078d6a0102f8e57a14a9cfa8a4c071221f
SHA512

210a7e399800a8f34908509aaaa8ec86fa1332189cfed60846f40391daa303744539b40b79b96ad30cb89982908aa3e779bdd93e1cd1a61040a2511e1808a09b
SSDEEP

12288:76VCTc6144GTqR/dm043FXlbiL20HZk0VfkeqL:qrc44GOR/o043FgXHdkzL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3360	d650789d2908031fe4eaf486fb62c554.exe

Executes dropped EXE 1 IoCs

pid	Process
3360	d650789d2908031fe4eaf486fb62c554.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	pastebin.com
25	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3360	d650789d2908031fe4eaf486fb62c554.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	d650789d2908031fe4eaf486fb62c554.exe
3360	d650789d2908031fe4eaf486fb62c554.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
744	d650789d2908031fe4eaf486fb62c554.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
744	d650789d2908031fe4eaf486fb62c554.exe
3360	d650789d2908031fe4eaf486fb62c554.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3360	744	d650789d2908031fe4eaf486fb62c554.exe	89
PID 744 wrote to memory of 3360	744	d650789d2908031fe4eaf486fb62c554.exe	89
PID 744 wrote to memory of 3360	744	d650789d2908031fe4eaf486fb62c554.exe	89
PID 3360 wrote to memory of 1820	3360	d650789d2908031fe4eaf486fb62c554.exe	91
PID 3360 wrote to memory of 1820	3360	d650789d2908031fe4eaf486fb62c554.exe	91
PID 3360 wrote to memory of 1820	3360	d650789d2908031fe4eaf486fb62c554.exe	91

C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe
"C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe
  C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d650789d2908031fe4eaf486fb62c554.exe

Filesize
506KB

MD5
f6f66eb3a04a76a66b4d01a2c4071b5f

SHA1
bc87d0b18ce11cd84a182a9a67e3e00146bae301

SHA256
e7a612a278074c52774e518f0ce137f4a209068e71de2b15b53b1ea6b71f08cb

SHA512
1d45dd3ab40c408feb00d98ce03bfea011a6797f4ad5265056162eacbc9e3edd0328c618c9b049c220e8b39308cc05518d0cfbf509330dd3759b6a597f8cd71a

Download Submit
memory/744-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/744-1-0x0000000001620000-0x00000000016A3000-memory.dmp

Filesize
524KB

Download
memory/744-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/744-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3360-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3360-17-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3360-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3360-20-0x0000000004F50000-0x0000000004FCE000-memory.dmp

Filesize
504KB

Download
memory/3360-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download