45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

Analysis

max time kernel
201s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe
Size

31KB
MD5

9ed3aac6e6179550c3f1b6c0fa6fb958
SHA1

1e2b7e4784c0559fe7527b01c2e9109707bbfdbe
SHA256

45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308
SHA512

ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a
SSDEEP

768:IHOVn8y773dAe/A6PdAalxbQxFj46s1F2nNd:v9PPdBTbQPj3sSnNd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
764	mstools.exe

Deletes itself 1 IoCs

pid	Process
764	mstools.exe

Loads dropped DLL 2 IoCs

pid	Process
992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe
992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 764	992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	28
PID 992 wrote to memory of 764	992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	28
PID 992 wrote to memory of 764	992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	28
PID 992 wrote to memory of 764	992	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	28

C:\Users\Admin\AppData\Local\Temp\45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe
"C:\Users\Admin\AppData\Local\Temp\45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\mstools.exe
  C:\Users\Admin\AppData\Local\Temp\mstools.exe
  2⤵
  - Executes dropped EXE
  - Deletes itself
  PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mstDC11.log

Filesize
206B

MD5
17871ce610431aa8ad9d29ff19fa20cb

SHA1
6b3b72817ad71f3bedade2b41366c963a7be351b

SHA256
dcce5776b9735818f5c2e72897404b95bface80995484cf62d7c42d500655d30

SHA512
d2eea0613ff39b157de4ebb8a90f5ce4614d69e787fb696d75a645262861e5101f30c02e30fa9409b9266b3ac2c1caee55fa0e088a09e78d68cfb1ad5fd94229

Download Submit
C:\Users\Admin\AppData\Local\Temp\mstools.exe

Filesize
31KB

MD5
9ed3aac6e6179550c3f1b6c0fa6fb958

SHA1
1e2b7e4784c0559fe7527b01c2e9109707bbfdbe

SHA256
45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

SHA512
ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a

Download Submit
\Users\Admin\AppData\Local\Temp\mstools.exe

Filesize
31KB

MD5
9ed3aac6e6179550c3f1b6c0fa6fb958

SHA1
1e2b7e4784c0559fe7527b01c2e9109707bbfdbe

SHA256
45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

SHA512
ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a

Download Submit
\Users\Admin\AppData\Local\Temp\mstools.exe

Filesize
31KB

MD5
9ed3aac6e6179550c3f1b6c0fa6fb958

SHA1
1e2b7e4784c0559fe7527b01c2e9109707bbfdbe

SHA256
45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

SHA512
ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a

Download Submit
memory/764-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/992-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download