318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 14:55

Target

318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe
Size

68KB
MD5

15667644ff0fc615f10f1bdb4aca1f50
SHA1

300c2d70aeaa96facd1bb89bc94dbeb9beaa3ea4
SHA256

318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484
SHA512

60993f9505650ae8e3b22a4ce8843ae4d359aa7678b574c370c7244d9e0fb2f305bfc2d4ff89d3396ae2fbed19424f424802f974333d75623d62bf22c6744872
SSDEEP

1536:1waBijItsn6faH3kktheBdJsX29YXWvTBVmiaYtVb:Ka2Usn6fmmBdJ79YXWlVmiTT

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1984	vadftol.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1984	4204	318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe	79
PID 4204 wrote to memory of 1984	4204	318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe	79
PID 4204 wrote to memory of 1984	4204	318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe	79

C:\Users\Admin\AppData\Local\Temp\318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe
"C:\Users\Admin\AppData\Local\Temp\318eb59f492c0dc7d51e1a656ce6be926416f756ba0ae1cb72b4dbc5570d1484.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\vadftol.exe
  C:\Users\Admin\AppData\Local\Temp\vadftol.exe
  2⤵
  - Executes dropped EXE
  PID:1984

C:\Users\Admin\AppData\Local\Temp\vadftol.exe

Filesize
69KB

MD5
58e054f5c730db8286956b4f596f739f

SHA1
7c877212e066ef198c1d9d57d15f04b47c15cc72

SHA256
1fe32751ea35f0be189958ff09b7e7b063e8cddae0179a6928ac5cdac5853ebe

SHA512
34a70d8daa5825e707043ea141c3e7945ad391e853cfd558facd6d1b90be7840c96bb7fa111fdc5749f7d8a24efc9f311397ba60096335c5bd47ae2082caa651

Download Submit
C:\Users\Admin\AppData\Local\Temp\vadftol.exe

Filesize
69KB

MD5
58e054f5c730db8286956b4f596f739f

SHA1
7c877212e066ef198c1d9d57d15f04b47c15cc72

SHA256
1fe32751ea35f0be189958ff09b7e7b063e8cddae0179a6928ac5cdac5853ebe

SHA512
34a70d8daa5825e707043ea141c3e7945ad391e853cfd558facd6d1b90be7840c96bb7fa111fdc5749f7d8a24efc9f311397ba60096335c5bd47ae2082caa651

Download Submit
memory/1984-136-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4204-135-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download