85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175

Analysis

max time kernel
176s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 00:01

Target

85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe
Size

65KB
MD5

a226cef2897577e39bfed4339554ea60
SHA1

e2207e72bdfb933ecb83ca42f80538e8281d0059
SHA256

85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175
SHA512

353f774fe9d258658de4e8c6ba4d1bba6c326d01ea880543ffa38ddd4111ff86e773257f4d8fe8e1fd975408b3d785e2378ddec550f1de324e31109f86ba1df7
SSDEEP

1536:Lty6kleKTOtSCsokaOwl+rtIkk8BM/TKLeBIDPWyd+/sVVX:soi0+rC8BM/uLeBIDeydF1

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1108	XYCcokade.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 1108	4384	85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe	81
PID 4384 wrote to memory of 1108	4384	85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe	81
PID 4384 wrote to memory of 1108	4384	85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe	81

C:\Users\Admin\AppData\Local\Temp\85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe
"C:\Users\Admin\AppData\Local\Temp\85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\XYCcokade.exe
  C:\Users\Admin\AppData\Local\Temp\XYCcokade.exe
  2⤵
  - Executes dropped EXE
  PID:1108

C:\Users\Admin\AppData\Local\Temp\XYC891.tmp

Filesize
206B

MD5
7c678c69e6f18c5062deae62d613cb9f

SHA1
13aa64238caf0f38ef69545853870619b5b5001a

SHA256
91d586466dc5fe92f1ac7a135af6987d56532f16398e1c6cc6650059642be7c8

SHA512
6c94c00a2bff45a6eff9b7e73c2dc83c43328b19a28333216637204505755493acd8dfd0ff6c28fe6fc57f975e61e4c5db6fc13b1e8ab15991f190ab35a826c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XYCcokade.exe

Filesize
65KB

MD5
a226cef2897577e39bfed4339554ea60

SHA1
e2207e72bdfb933ecb83ca42f80538e8281d0059

SHA256
85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175

SHA512
353f774fe9d258658de4e8c6ba4d1bba6c326d01ea880543ffa38ddd4111ff86e773257f4d8fe8e1fd975408b3d785e2378ddec550f1de324e31109f86ba1df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XYCcokade.exe

Filesize
65KB

MD5
a226cef2897577e39bfed4339554ea60

SHA1
e2207e72bdfb933ecb83ca42f80538e8281d0059

SHA256
85438767b1b07108328e8128dd321d1e6175705b3b07d3274788c3230741f175

SHA512
353f774fe9d258658de4e8c6ba4d1bba6c326d01ea880543ffa38ddd4111ff86e773257f4d8fe8e1fd975408b3d785e2378ddec550f1de324e31109f86ba1df7

Download Submit
memory/1108-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4384-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download