3d445366066d1c084f489995e476abe8e1204fa1918468868c4f90cabd2e5817

General

Target

lab_02_win10x64/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

pid	process
1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
1812	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
4080	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 icanhazip.com
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe

flow	ioc
15	icanhazip.com

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

description	pid	process	target process
PID 856 wrote to memory of 1328	856	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 856 wrote to memory of 1328	856	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 856 wrote to memory of 1328	856	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1328 wrote to memory of 3168	1328	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
"C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SYSTEM32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:3168

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
2⤵
- Modifies data under HKEY_USERS
PID:3844

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
2⤵
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
memory/856-117-0x0000000000780000-0x00000000007BC000-memory.dmp

Filesize
240KB

Download
memory/856-116-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/856-114-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/856-115-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1328-118-0x0000000000000000-mapping.dmp

Download
memory/1328-136-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1328-122-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1328-123-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/1328-126-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1812-154-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/1812-140-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1812-141-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/2320-165-0x0000000000000000-mapping.dmp

Download
memory/3168-137-0x000002B999DA0000-0x000002B999DA1000-memory.dmp

Filesize
4KB

Download
memory/3168-131-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/3168-129-0x0000000000000000-mapping.dmp

Download
memory/3844-147-0x0000000000000000-mapping.dmp

Download
memory/4080-158-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4080-159-0x00000000004B0000-0x00000000005FA000-memory.dmp

Filesize
1.3MB

Download
memory/4080-172-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing