Analysis
- max time kernel
70s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
03/08/2020, 06:59
General
- Target b803593f93796171cf128e2d282ac0ff.exe
- Size 227KB
- Sample200803-sqkd9cf63x
- SHA256 60ac80da516e77efa3c2bd15a97768ad1535ec456ca8dccbdcf75b4c404fd591
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b803593f93796171cf128e2d282ac0ff.exe"C:\Users\Admin\AppData\Local\Temp\b803593f93796171cf128e2d282ac0ff.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\dwmqt\cxrckdh.exeC:\ProgramData\dwmqt\cxrckdh.exe start1⤵
- Executes dropped EXE