9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d

Analysis

max time kernel
138s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 00:53

Target

9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe
Size

64KB
MD5

51884c7b5279e86aa9aea329d87c30b0
SHA1

c1039ad900847c6ddaa7bde4a5832ccd4ebd9292
SHA256

9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d
SHA512

5622315807d2f1133cfd975dc37cb957bc624ba9db99cea32eae21232fda2da33c8cffbd0adea776f33a3ab2ef149a9e3676119d1edb0fbd7956d430e4ff9171
SSDEEP

1536:m2QZPC8h+7Y33Pz/Y+MIYEfFdexywag44objP:m2QZ6aLY+wENdexywag44obj

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4856	jacgitaf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4856	5112	9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe	82
PID 5112 wrote to memory of 4856	5112	9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe	82
PID 5112 wrote to memory of 4856	5112	9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe	82

C:\Users\Admin\AppData\Local\Temp\9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe
"C:\Users\Admin\AppData\Local\Temp\9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\jacgitaf.exe
  C:\Users\Admin\AppData\Local\Temp\jacgitaf.exe
  2⤵
  - Executes dropped EXE
  PID:4856

C:\Users\Admin\AppData\Local\Temp\jacgitaf.exe

Filesize
64KB

MD5
51884c7b5279e86aa9aea329d87c30b0

SHA1
c1039ad900847c6ddaa7bde4a5832ccd4ebd9292

SHA256
9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d

SHA512
5622315807d2f1133cfd975dc37cb957bc624ba9db99cea32eae21232fda2da33c8cffbd0adea776f33a3ab2ef149a9e3676119d1edb0fbd7956d430e4ff9171

Download Submit
C:\Users\Admin\AppData\Local\Temp\jacgitaf.exe

Filesize
64KB

MD5
51884c7b5279e86aa9aea329d87c30b0

SHA1
c1039ad900847c6ddaa7bde4a5832ccd4ebd9292

SHA256
9ff69c5c42a3a05987258f2caee61b3ee1a62ab96ae5fc9da08878fea902cc7d

SHA512
5622315807d2f1133cfd975dc37cb957bc624ba9db99cea32eae21232fda2da33c8cffbd0adea776f33a3ab2ef149a9e3676119d1edb0fbd7956d430e4ff9171

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempjac.txt

Filesize
206B

MD5
eb96bc930914ee384e8bc5619e3cf6f7

SHA1
8182d13ac9ece1d0b5d3385003a43378cd5a7625

SHA256
ba8abbc0526a708b0272c73802b5150337a13d8a61b0bbb72693b98c67600417

SHA512
754b5a16f1b4627427e1cb2d181d1e87d82370f290b1e2775293231d60ff51048f7f6fb4a984f241e6742c40dce883b0ffb3b60d00bc7e2b62d1031b92ebfd2b

Download Submit
memory/4856-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5112-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5112-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download