45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

Analysis

max time kernel
114s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:53

Target

45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe
Size

31KB
MD5

9ed3aac6e6179550c3f1b6c0fa6fb958
SHA1

1e2b7e4784c0559fe7527b01c2e9109707bbfdbe
SHA256

45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308
SHA512

ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a
SSDEEP

768:IHOVn8y773dAe/A6PdAalxbQxFj46s1F2nNd:v9PPdBTbQPj3sSnNd

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3124	mstools.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3124	5076	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	81
PID 5076 wrote to memory of 3124	5076	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	81
PID 5076 wrote to memory of 3124	5076	45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe	81

C:\Users\Admin\AppData\Local\Temp\45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe
"C:\Users\Admin\AppData\Local\Temp\45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\mstools.exe
  C:\Users\Admin\AppData\Local\Temp\mstools.exe
  2⤵
  - Executes dropped EXE
  PID:3124

C:\Users\Admin\AppData\Local\Temp\mstDC11.log

Filesize
206B

MD5
17871ce610431aa8ad9d29ff19fa20cb

SHA1
6b3b72817ad71f3bedade2b41366c963a7be351b

SHA256
dcce5776b9735818f5c2e72897404b95bface80995484cf62d7c42d500655d30

SHA512
d2eea0613ff39b157de4ebb8a90f5ce4614d69e787fb696d75a645262861e5101f30c02e30fa9409b9266b3ac2c1caee55fa0e088a09e78d68cfb1ad5fd94229

Download Submit
C:\Users\Admin\AppData\Local\Temp\mstools.exe

Filesize
31KB

MD5
9ed3aac6e6179550c3f1b6c0fa6fb958

SHA1
1e2b7e4784c0559fe7527b01c2e9109707bbfdbe

SHA256
45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

SHA512
ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mstools.exe

Filesize
31KB

MD5
9ed3aac6e6179550c3f1b6c0fa6fb958

SHA1
1e2b7e4784c0559fe7527b01c2e9109707bbfdbe

SHA256
45ff9d6bd81b85206bf349863573576f7953ae9617edc1bd699b61048c639308

SHA512
ba37503d69a2fab6138f5e32d6e273823215e0d3a3899696ace0adca7e50514998fe1c54080ace724873fa6568ba322a725ba3cdb538e7871ba6c6e4ff76833a

Download Submit
memory/3124-137-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5076-132-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download