f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239

General

Target

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe
Size

786KB
MD5

7c9d76a439b166b02a57b7844f3eaf8b
SHA1

3fd3ab56d920cd366ef709f227261efe8c843582
SHA256

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239
SHA512

048bcbd394b053b2f61c544ab98b25da965c64820dbbf09c7aebf9201086cf530e106d6d458818c9e858f48d85df810c31fa5bd765825d05168818e5ef15f2fe

Score

6^/10

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

description	pid	Process	procid_target
PID 1480 set thread context of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1156	744	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

pid	Process
1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exef6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

description	pid	Process
Token: SeDebugPrivilege	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe
Token: SeDebugPrivilege	744	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exef6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe

description	pid	Process	procid_target
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 1480 wrote to memory of 744	1480	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	26
PID 744 wrote to memory of 1156	744	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	28
PID 744 wrote to memory of 1156	744	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	28
PID 744 wrote to memory of 1156	744	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	28
PID 744 wrote to memory of 1156	744	f6fdbda19458f6eb1380e0e0aaaaf979c49221c4c2a0255d9f78cb9112bdb239.exe	28

memory/744-62-0x0000000000494142-mapping.dmp

Download
memory/744-56-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-57-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-59-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-60-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-63-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-64-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-68-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-71-0x0000000000080000-0x000000000011C000-memory.dmp

Filesize
624KB

Download
memory/744-72-0x00000000054C0000-0x0000000005536000-memory.dmp

Filesize
472KB

Download
memory/1156-73-0x0000000000000000-mapping.dmp

Download
memory/1480-55-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/1480-54-0x0000000000210000-0x00000000002DA000-memory.dmp

Filesize
808KB

Download