3d445366066d1c084f489995e476abe8e1204fa1918468868c4f90cabd2e5817

General

Target

lab_02_win10x64/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

pid	process
1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
1852	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

Loads dropped DLL 2 IoCs

Processes:

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

pid	process
1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io

flow	ioc
5	ipinfo.io

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

description	pid	process	target process
PID 1968 wrote to memory of 1632	1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1968 wrote to memory of 1632	1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1968 wrote to memory of 1632	1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1968 wrote to memory of 1632	1968	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1632 wrote to memory of 1392	1632	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
"C:\Users\Admin\AppData\Local\Temp\lab_02_win10x64\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:1392

C:\Windows\system32\taskeng.exe
taskeng.exe {2548F0E5-A881-4E08-AC7F-6DCA1E6D6415} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:928

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2⤵
- Executes dropped EXE
PID:1852

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
memory/792-98-0x0000000000000000-mapping.dmp

Download
memory/1392-77-0x0000000000000000-mapping.dmp

Download
memory/1392-85-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1392-79-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1632-71-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1632-84-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1632-74-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1632-69-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1632-66-0x0000000000000000-mapping.dmp

Download
memory/1852-90-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1852-87-0x0000000000000000-mapping.dmp

Download
memory/1852-92-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1852-105-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1968-63-0x00000000004B0000-0x00000000004EC000-memory.dmp

Filesize
240KB

Download
memory/1968-62-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1968-61-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1968-60-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1968-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads