eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537

Analysis

max time kernel
132s
max time network
149s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe
Size

73KB
MD5

05973091e06ecdfd2cc7fdc491996461
SHA1

701df16b3ced710cc82dd3bb1899cd2ae1b80984
SHA256

eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537
SHA512

b498265d5cbd51fe76d7337b9fcad462b0f851ae71c9d1b76c40c0e49e6bd52989b8addeeef92795d0f85e056b8f5462e1039fd70513d6ae9f754febfb4ebf87
SSDEEP

1536:0ZKaLOllgAXW9jl98e+Ni6bbbbxNi6bbbbbWUW:ALilbk9aj/9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1680	lifikuri.exe

Deletes itself 1 IoCs

pid	Process
1680	lifikuri.exe

Loads dropped DLL 2 IoCs

pid	Process
1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe
1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1680	1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe	27
PID 1696 wrote to memory of 1680	1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe	27
PID 1696 wrote to memory of 1680	1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe	27
PID 1696 wrote to memory of 1680	1696	eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe	27

C:\Users\Admin\AppData\Local\Temp\eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe
"C:\Users\Admin\AppData\Local\Temp\eefeeb2d64fa4963e237cb0c9cf5e22a0dd416f7b75331242d0940b7f9cce537.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\lifikuri.exe
  "C:\Users\Admin\AppData\Local\Temp\lifikuri.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lifikuri.exe

Filesize
73KB

MD5
ab1e992f867ea156a82f3e6e6e58746e

SHA1
09ae0d04bbe26ffc12d8d0069cda8974fd9c4de5

SHA256
113a13934b263ed388aadfb5a7a33986117795843ce20d550e8652af23df9b24

SHA512
2a1d9ca6e8aa5e7042ee422e03abd692c413b722c49dcbd4a52b1c6565c2e53081942d8d56472cdb27b63549184953c67dcdf76c2999df20680fd18eb1c1146b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lifikuri.exe

Filesize
73KB

MD5
ab1e992f867ea156a82f3e6e6e58746e

SHA1
09ae0d04bbe26ffc12d8d0069cda8974fd9c4de5

SHA256
113a13934b263ed388aadfb5a7a33986117795843ce20d550e8652af23df9b24

SHA512
2a1d9ca6e8aa5e7042ee422e03abd692c413b722c49dcbd4a52b1c6565c2e53081942d8d56472cdb27b63549184953c67dcdf76c2999df20680fd18eb1c1146b

Download Submit
\Users\Admin\AppData\Local\Temp\lifikuri.exe

Filesize
73KB

MD5
ab1e992f867ea156a82f3e6e6e58746e

SHA1
09ae0d04bbe26ffc12d8d0069cda8974fd9c4de5

SHA256
113a13934b263ed388aadfb5a7a33986117795843ce20d550e8652af23df9b24

SHA512
2a1d9ca6e8aa5e7042ee422e03abd692c413b722c49dcbd4a52b1c6565c2e53081942d8d56472cdb27b63549184953c67dcdf76c2999df20680fd18eb1c1146b

Download Submit
\Users\Admin\AppData\Local\Temp\lifikuri.exe

Filesize
73KB

MD5
ab1e992f867ea156a82f3e6e6e58746e

SHA1
09ae0d04bbe26ffc12d8d0069cda8974fd9c4de5

SHA256
113a13934b263ed388aadfb5a7a33986117795843ce20d550e8652af23df9b24

SHA512
2a1d9ca6e8aa5e7042ee422e03abd692c413b722c49dcbd4a52b1c6565c2e53081942d8d56472cdb27b63549184953c67dcdf76c2999df20680fd18eb1c1146b

Download Submit
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000530000-0x0000000000555000-memory.dmp

Filesize
148KB

Download
memory/1696-56-0x0000000000400000-0x00000000004243F0-memory.dmp

Filesize
144KB

Download