59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70 | Triage

Analysis

max time kernel
4294177s
max time network
131s
platform
windows7_x64
resource
win7-20220310-en
submitted
10-03-2022 15:38

Sharing

Report Analysis Logs

General

Target

59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe
Size

552KB
MD5

42972a9a5ab46a5dcc9e72389c069db7
SHA1

53db1c679729bafccbcb35c64ca7f3e04aa7d9d8
SHA256

59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70
SHA512

26b1ccfe16ec9c25a878573896ee6afffdc150376b18857b3a45e03db67add767b065d6b03806c7692388100b23186d0ca2483f9514daad5a51c9dcce608d025

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com

C:\Users\Admin\AppData\Local\Temp\59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe
"C:\Users\Admin\AppData\Local\Temp\59ef5b795db30415b8b7cd21b186105e70a71f5e21bf1d2224ca5e6b58145e70.exe"
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-54-0x0000000076361000-0x0000000076363000-memory.dmp

Filesize
8KB

Download
memory/1560-55-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/1560-56-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1560-57-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download