f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 11:41

Target

f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe
Size

35KB
MD5

84a6ecada6bd33e6b5a7cb81e5477580
SHA1

bd78ef42b5058b7e60ac18f813c76aa62590f5a1
SHA256

f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6
SHA512

7cfe589829044612d461eda4692601340a5e865266feb294249903ff2bcbcb7520cc0478e14f6e67d7a510c7f3596c4556d9930bcd433f4c22b8cd962c6a78a9
SSDEEP

768:JwS9cpS5ipComcPcFpcuWjQyr3eWovq2ARwvQ7QF:JwfpSEvm+cFpcuWjQyr3eWovq2ARwvQq

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
828	rekgernel.exe

Loads dropped DLL 1 IoCs

pid	Process
1200	f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 828	1200	f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe	27
PID 1200 wrote to memory of 828	1200	f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe	27
PID 1200 wrote to memory of 828	1200	f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe	27
PID 1200 wrote to memory of 828	1200	f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe	27

C:\Users\Admin\AppData\Local\Temp\f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe
"C:\Users\Admin\AppData\Local\Temp\f62485ff54fa9807f64cf47c66b4eff33b0b86e39d129af56714c8378e9fb3f6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\rekgernel.exe
  C:\Users\Admin\AppData\Local\Temp\rekgernel.exe
  2⤵
  - Executes dropped EXE
  PID:828

C:\Users\Admin\AppData\Local\Temp\rekgernel.exe

Filesize
35KB

MD5
d948d55ae90472426fa5dd7aa108cc73

SHA1
29af4832e11e1001896eb87a319c3d299fc851fe

SHA256
e561c91b5df4aaa9fd6e7a37102a12dafaa59d95f6a93cab4bdb35ca87fc8a61

SHA512
daa54629cf9e087bdd72e50c412b4ba1c61ae84bda493dd70ba219ed4184d828b7bf0b0396be940e962178a2f2826fb06017d18983e1c58b3c58e50d6db3a69a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rekgernel.exe

Filesize
35KB

MD5
d948d55ae90472426fa5dd7aa108cc73

SHA1
29af4832e11e1001896eb87a319c3d299fc851fe

SHA256
e561c91b5df4aaa9fd6e7a37102a12dafaa59d95f6a93cab4bdb35ca87fc8a61

SHA512
daa54629cf9e087bdd72e50c412b4ba1c61ae84bda493dd70ba219ed4184d828b7bf0b0396be940e962178a2f2826fb06017d18983e1c58b3c58e50d6db3a69a

Download Submit
\Users\Admin\AppData\Local\Temp\rekgernel.exe

Filesize
35KB

MD5
d948d55ae90472426fa5dd7aa108cc73

SHA1
29af4832e11e1001896eb87a319c3d299fc851fe

SHA256
e561c91b5df4aaa9fd6e7a37102a12dafaa59d95f6a93cab4bdb35ca87fc8a61

SHA512
daa54629cf9e087bdd72e50c412b4ba1c61ae84bda493dd70ba219ed4184d828b7bf0b0396be940e962178a2f2826fb06017d18983e1c58b3c58e50d6db3a69a

Download Submit
memory/828-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/828-60-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1200-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download