dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21

Analysis

max time kernel
152s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:19

Target

dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe
Size

116KB
MD5

e5605c2fa197d33290e7d72741cdb6f0
SHA1

5586e363f0c8b79e27a7049c800437af0a6ab0ff
SHA256

dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21
SHA512

03ca796f44075418816fb8933e06d02a53997f10982a1b57053c70a608b891ad91d986a86fea0925dc8fe37aa2d3db5b4c8692cbf4565b8b9ecc1552f08a322a
SSDEEP

1536:kpr40ncogoqvSDD2TXm+OvD5a2IznYaHjubg:Y9coBGTXOr5a2Issa8

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2056	gotfree.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2056	1028	dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe	80
PID 1028 wrote to memory of 2056	1028	dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe	80
PID 1028 wrote to memory of 2056	1028	dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe	80

C:\Users\Admin\AppData\Local\Temp\dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe
"C:\Users\Admin\AppData\Local\Temp\dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\gotfree.exe
  C:\Users\Admin\AppData\Local\Temp\gotfree.exe
  2⤵
  - Executes dropped EXE
  PID:2056

C:\Users\Admin\AppData\Local\Temp\got2D80.txt

Filesize
206B

MD5
5f90aa965de612b72e5a502574612a03

SHA1
d732b68760d6f5c7958c23a1dd411137dd32b807

SHA256
997b275b0f80779f5d593286e18b12101e8488085e96f0c96d6e6579c9bb0199

SHA512
77b741b0ae55799353f59656ffb9bfe41c3f1cc5d386ffdf44400ef81fd6ad7c0c7837f5f316089955416034d5b11de562c44b8c79d08cfde2d702a044b2331c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gotfree.exe

Filesize
116KB

MD5
e5605c2fa197d33290e7d72741cdb6f0

SHA1
5586e363f0c8b79e27a7049c800437af0a6ab0ff

SHA256
dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21

SHA512
03ca796f44075418816fb8933e06d02a53997f10982a1b57053c70a608b891ad91d986a86fea0925dc8fe37aa2d3db5b4c8692cbf4565b8b9ecc1552f08a322a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gotfree.exe

Filesize
116KB

MD5
e5605c2fa197d33290e7d72741cdb6f0

SHA1
5586e363f0c8b79e27a7049c800437af0a6ab0ff

SHA256
dd057de8165b4cdc4321df808ccf52b9016d7fe86b6f8a2cbab3c034df76da21

SHA512
03ca796f44075418816fb8933e06d02a53997f10982a1b57053c70a608b891ad91d986a86fea0925dc8fe37aa2d3db5b4c8692cbf4565b8b9ecc1552f08a322a

Download Submit
memory/1028-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2056-137-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download