1612c1e0be2ca02cfce80bf05a8894685398f073cf88336ef6d4fd09fc0dedef

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/08/2022, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Lazy.234899.25717.exe
Size 227KB
Sample220817-mpdbpsedbj
SHA256 1612c1e0be2ca02cfce80bf05a8894685398f073cf88336ef6d4fd09fc0dedef
MD5 fe02f0ff20e7352a93bc6e0a572a9b24
SHA1 f4403d5721878ab06c76adea3a691512baa846e9
SHA512 32bc48e7640c042443d07dd12406d503f35e3c545222cfeb03e87458e5ed1aaf1a61e6af60dc81409af5c4d279a0f380e6e963a94e090a914eeaa2962fa085d1
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
556	dd7f29de.exe

Loads dropped DLL 1 IoCs

pid	Process
1476	cmd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.amazonaws.com
5	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1056	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	RegSvcs.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 1992 wrote to memory of 896	1992	SecuriteInfo.com.Variant.Lazy.234899.25717.exe	27
PID 896 wrote to memory of 1476	896	RegSvcs.exe	29
PID 896 wrote to memory of 1476	896	RegSvcs.exe	29
PID 896 wrote to memory of 1476	896	RegSvcs.exe	29
PID 896 wrote to memory of 1476	896	RegSvcs.exe	29
PID 1476 wrote to memory of 2032	1476	cmd.exe	31
PID 1476 wrote to memory of 2032	1476	cmd.exe	31
PID 1476 wrote to memory of 2032	1476	cmd.exe	31
PID 1476 wrote to memory of 2032	1476	cmd.exe	31
PID 1476 wrote to memory of 1056	1476	cmd.exe	32
PID 1476 wrote to memory of 1056	1476	cmd.exe	32
PID 1476 wrote to memory of 1056	1476	cmd.exe	32
PID 1476 wrote to memory of 1056	1476	cmd.exe	32
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33
PID 1476 wrote to memory of 556	1476	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.25717.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.25717.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB32A.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d "C:\ProgramData\Internet User v4.8.3"
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      Delays execution with timeout.exe
      PID:1056
  - - C:\ProgramData\Internet User v4.8.3\dd7f29de.exe
      "C:\ProgramData\Internet User v4.8.3\dd7f29de.exe"
      4⤵
      Executes dropped EXE
      PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

dd7f29de.exe

Path C:\ProgramData\Internet User v4.8.3\dd7f29de.exe
Size 10.3MB
SHA256 0069f07cfae43ae5c3db99323f37de1445712d9a7f0f867a35bc44324dbc6a10
MD5 632dfe352533ef8e9cbcdcf62ffc98c9
SHA1 f16dbbd21be0854bedd00c3d1137dfce4df96038
SHA512 eaaad1030111153e53515b4d92780fb0e60fe0cb92d2f4e8903349ea5e404e6f0fc160caa45a27fbf05e7f41f599b65363de9337c91f3f410eb9cc55bbc4a30f
SSDEEP 196608:wcJGF1XLWU1i+X5DF8MzQFLlCu5eUkdQeX9ft75zLzYKLrH0iL5q5:lS1Xk+phQZlJ5eUapt753v5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd7f29de.exe

Path C:\ProgramData\Internet User v4.8.3\dd7f29de.exe
Size 10.3MB
SHA256 0069f07cfae43ae5c3db99323f37de1445712d9a7f0f867a35bc44324dbc6a10
MD5 632dfe352533ef8e9cbcdcf62ffc98c9
SHA1 f16dbbd21be0854bedd00c3d1137dfce4df96038
SHA512 eaaad1030111153e53515b4d92780fb0e60fe0cb92d2f4e8903349ea5e404e6f0fc160caa45a27fbf05e7f41f599b65363de9337c91f3f410eb9cc55bbc4a30f
SSDEEP 196608:wcJGF1XLWU1i+X5DF8MzQFLlCu5eUkdQeX9ft75zLzYKLrH0iL5q5:lS1Xk+phQZlJ5eUapt753v5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB32A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpB32A.tmp.bat
Size 342B
SHA256 be17ba54f17ad3ab16501a795f3e47fef02cb78f8d74336a42517b48092cd9df
MD5 a1cc0095b4305f68eba1f7a1f950ce02
SHA1 85c8591121b19e9a6f196a315cb50438c87bd476
SHA512 97ca9798cc324302b189714c6180ab20e3456642dafa2ed8364cb8cae129057f3aeb7fa2c939b5764d4aa0c12a656e27e4a642193c6c3de8ec4d306f164ba301
MD5 SHA1 SHA512

Submit Download

dd7f29de.exe

Path \ProgramData\Internet User v4.8.3\dd7f29de.exe
Size 10.3MB
SHA256 0069f07cfae43ae5c3db99323f37de1445712d9a7f0f867a35bc44324dbc6a10
MD5 632dfe352533ef8e9cbcdcf62ffc98c9
SHA1 f16dbbd21be0854bedd00c3d1137dfce4df96038
SHA512 eaaad1030111153e53515b4d92780fb0e60fe0cb92d2f4e8903349ea5e404e6f0fc160caa45a27fbf05e7f41f599b65363de9337c91f3f410eb9cc55bbc4a30f
SSDEEP 196608:wcJGF1XLWU1i+X5DF8MzQFLlCu5eUkdQeX9ft75zLzYKLrH0iL5q5:lS1Xk+phQZlJ5eUapt753v5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-74-0x00000000004B0000-0x00000000004D0000-memory.dmp

Download

memory/556-73-0x0000000000C20000-0x0000000000C2E000-memory.dmp

Download

memory/896-62-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/896-64-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/896-54-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/896-63-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/896-56-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads