cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278 | Triage

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-en-20211014
submitted
01/11/2021, 14:48

Sharing

Report Analysis Logs

General

Target

cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278.exe
Size

26KB
MD5

dedec1a6104f9dfb8d7a4c592bffa6fe
SHA1

401bb6b5b5965e65b6c141f184e97a8494281aa9
SHA256

cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278
SHA512

75ddad8c616dbba86dcb0c8fdcaf3e779124f58b5c37de4cca2c8c9db935867feae80e76f955b06b405b4cf866b4065f89b8ac5e78ee35ded06e89b4abc72703

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
804	cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278.exe

C:\Users\Admin\AppData\Local\Temp\cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278.exe
"C:\Users\Admin\AppData\Local\Temp\cf0e40628bf7472926605576ba2250520b5dc8cf99d9d6eb78357d4fcad4d278.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download