5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4

Analysis

max time kernel
202s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 00:51

Target

5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
Size

611KB
MD5

21ec30fd5c386931798cde196d6189ba
SHA1

776e0c2fc04d0ac30df0749815349c8be563de01
SHA256

5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4
SHA512

6896047be229b5c3d3829aeb87904650376585992a48d7e2e45e43af50b5f60bbf10c812f8b0f6ff1208d1a3789ecaf9eff0046713c62aa2165307e6721d47aa
SSDEEP

6144:iJQ7eE3M0V8DaCQwDqqkxrx5rW4W0EcDdprqsYoQH4p4IPz7lvgHeUAMQYZ2zMvE:isHV8a6H2TEqWsYomF0vF5rzKEqj6Pu

Score

6^/10

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

76 whatismyipaddress.com

flow	ioc
76	whatismyipaddress.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

description	pid	process	target process
PID 3960 set thread context of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

description pid process

Token: SeDebugPrivilege 3960 5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

description	pid	process
Token: SeDebugPrivilege	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

description	pid	process	target process
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
PID 3960 wrote to memory of 924	3960	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe	5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe

C:\Users\Admin\AppData\Local\Temp\5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe
"C:\Users\Admin\AppData\Local\Temp\5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe"
2⤵
PID:924

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4.exe.log

Filesize
496B

MD5
cb76b18ebed3a9f05a14aed43d35fba6

SHA1
836a4b4e351846fca08b84149cb734cb59b8c0d6

SHA256
8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

SHA512
7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

Download Submit
memory/924-134-0x0000000000000000-mapping.dmp

Download
memory/924-138-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download
memory/924-139-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download
memory/3960-132-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download
memory/3960-133-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download
memory/3960-137-0x0000000074CE0000-0x0000000075291000-memory.dmp

Filesize
5.7MB

Download