8ceee34b010701c3745db2e9868c68902440d951d7c2dbe383ee2c25d5aa20dc

Analysis

Target
a2d724e306338577a5896594950d41a5.exe
Size 335KB
Sample200926-pvbxpxvrqa
SHA256 8ceee34b010701c3745db2e9868c68902440d951d7c2dbe383ee2c25d5aa20dc
MD5 a2d724e306338577a5896594950d41a5
SHA1 7914ac4f3911cd4ea2aa15546a6f14cabe89b55d
SHA512 af91fbca78e583ff5a9cc211b154fb5043918fde3d8b0e93e22d9b08e0d0e05ce03bb8e7b7c62a1ac07e2d7b85332badedd03bd681c05dfb0de6e79e2c616526
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1640	ivvw.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ivvw.job	a2d724e306338577a5896594950d41a5.exe
File opened for modification	C:\Windows\Tasks\ivvw.job	a2d724e306338577a5896594950d41a5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1448	a2d724e306338577a5896594950d41a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1640	1648	taskeng.exe	29
PID 1648 wrote to memory of 1640	1648	taskeng.exe	29
PID 1648 wrote to memory of 1640	1648	taskeng.exe	29
PID 1648 wrote to memory of 1640	1648	taskeng.exe	29

C:\Windows\system32\taskeng.exe
taskeng.exe {132F58B4-33E3-4394-8AFC-6411A6FF0CF3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\ProgramData\corbucj\ivvw.exe
  C:\ProgramData\corbucj\ivvw.exe start
  2⤵
  - Executes dropped EXE
  PID:1640

memory/1448-0-0x0000000004EDA000-0x0000000004EDB000-memory.dmp

Download

memory/1448-1-0x0000000004FC0000-0x0000000004FD1000-memory.dmp

Download

memory/1640-5-0x0000000004E8A000-0x0000000004E8B000-memory.dmp

Download

memory/1640-6-0x00000000050D0000-0x00000000050E1000-memory.dmp

Download