93c54da7adbb2872bb4fd20d4ba4a2ad0156437c49d2a2c63bd2d3411c25030f

Analysis

Target
19cc209d16c119c2ea019d6514b564c1.exe
Size 227KB
Sample200804-pwvm81ce3a
SHA256 93c54da7adbb2872bb4fd20d4ba4a2ad0156437c49d2a2c63bd2d3411c25030f
MD5 19cc209d16c119c2ea019d6514b564c1
SHA1 6f1f4cdf518962b13ccb061b78d9b56b22373725
SHA512 44f2a04b1cc2c033b74ddb4583991308bbcdfbc82a1becea369bfbe6c675bb417e97d144f72f10a8af0f4be7456f07016b998ad10c02e6d29a44afbe01ceab23
MD5 SHA1 SHA512

Score

8^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\awmctf.job	19cc209d16c119c2ea019d6514b564c1.exe
File opened for modification	C:\Windows\Tasks\awmctf.job	19cc209d16c119c2ea019d6514b564c1.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1544	19cc209d16c119c2ea019d6514b564c1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 756	892	taskeng.exe	25
PID 892 wrote to memory of 756	892	taskeng.exe	25
PID 892 wrote to memory of 756	892	taskeng.exe	25
PID 892 wrote to memory of 756	892	taskeng.exe	25

Executes dropped EXE 1 IoCs

pid	Process
756	awmctf.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {A368E2AA-7E8D-4139-B4EA-A36F44C5B3CA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\ProgramData\bqri\awmctf.exe
  C:\ProgramData\bqri\awmctf.exe start
  2⤵
  - Executes dropped EXE
  PID:756