Analysis
- max time kernel
144s - max time network
149s - platform
windows10_x64 - resource
win10v200722 - submitted
04/08/2020, 06:46
General
- Target 19cc209d16c119c2ea019d6514b564c1.exe
- Size 227KB
- Sample200804-pwvm81ce3a
- SHA256 93c54da7adbb2872bb4fd20d4ba4a2ad0156437c49d2a2c63bd2d3411c25030f
Score
8/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19cc209d16c119c2ea019d6514b564c1.exe"C:\Users\Admin\AppData\Local\Temp\19cc209d16c119c2ea019d6514b564c1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
-
C:\ProgramData\cndtle\lkllbbp.exeC:\ProgramData\cndtle\lkllbbp.exe start1⤵
- Executes dropped EXE