f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223

Analysis

max time kernel
129s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 13:55

Target

f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe
Size

59KB
MD5

84ca83c34939273cb6382a9381d86c10
SHA1

a1ca78fdac5f94194f200d60eb6296bd467c71c7
SHA256

f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223
SHA512

be979eb201cd9d31e830c3bdea999c78d436a26a7b1a5164d5ccf3954ca67b115581154e31ecf7f1532d46b671f67168cc2108845e674140a6db80e721570f2a
SSDEEP

1536:lJudWi4JQCA97xk+1XmsPrG42X3LEvcSw:PudyJgxk+tmsPrG42HLEvcS

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
980	ticxofad.exe

Deletes itself 1 IoCs

pid	Process
980	ticxofad.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 980	1696	f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe	27
PID 1696 wrote to memory of 980	1696	f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe	27
PID 1696 wrote to memory of 980	1696	f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe	27
PID 1696 wrote to memory of 980	1696	f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223.exe	27

C:\Users\Admin\AppData\Local\Temp\LogXofad.txt

Filesize
206B

MD5
58727dbae7a7178fb218b1c59070a7c6

SHA1
80c1b622361b1f01abf03f4b26aecc1330abdb01

SHA256
7009e733aef3e1c16b60630c79d289837d78be497601940da5e76741d4c93af3

SHA512
d66a9dfc4fee136e46ca6993d626b709bf469e8ff649910f2f8c49fd883bc92834b5b912fcd2e5da6126afd8ea2e64d9a87914edebbaf4ac89156915f3d7700a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ticxofad.exe

Filesize
59KB

MD5
84ca83c34939273cb6382a9381d86c10

SHA1
a1ca78fdac5f94194f200d60eb6296bd467c71c7

SHA256
f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223

SHA512
be979eb201cd9d31e830c3bdea999c78d436a26a7b1a5164d5ccf3954ca67b115581154e31ecf7f1532d46b671f67168cc2108845e674140a6db80e721570f2a

Download Submit
\Users\Admin\AppData\Local\Temp\ticxofad.exe

Filesize
59KB

MD5
84ca83c34939273cb6382a9381d86c10

SHA1
a1ca78fdac5f94194f200d60eb6296bd467c71c7

SHA256
f8f8afc05d6148747b13bc66c093aafb44e0a09acdc5de0f9342980cab29e223

SHA512
be979eb201cd9d31e830c3bdea999c78d436a26a7b1a5164d5ccf3954ca67b115581154e31ecf7f1532d46b671f67168cc2108845e674140a6db80e721570f2a

Download Submit
memory/980-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download