40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b

Resubmissions

22-02-2023 10:35

22-02-2023 10:19

max time kernel
53s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2023 10:19

Target

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
Size

7.2MB
MD5

9606143c857bbfe1b1da8e3d1fa9ae0e
SHA1

cb3a1b1d8e6acbe46c96b5b159a7be2d372b3cc6
SHA256

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b
SHA512

2e118c618265b8769b15dff8add661c60f17afd46365773ca22e359b03a765c83a7f316057045293a71b53a889771fadf54e6ac1ee3fd9b3a7437f266f8af08b
SSDEEP

196608:jeuNPzUCugRPeW7R9dGfqEjirb49GOD2MpkB:CmZB77R9d0q1A9GLM

Score

6^/10

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipinfo.io
6 ipinfo.io

flow	ioc
7	ipinfo.io
6	ipinfo.io

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.execmd.exe

description	pid	process	target process
PID 2980 wrote to memory of 4272	2980	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	cmd.exe
PID 2980 wrote to memory of 4272	2980	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	cmd.exe
PID 2980 wrote to memory of 4272	2980	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	cmd.exe
PID 4272 wrote to memory of 3500	4272	cmd.exe	tzutil.exe
PID 4272 wrote to memory of 3500	4272	cmd.exe	tzutil.exe
PID 4272 wrote to memory of 3500	4272	cmd.exe	tzutil.exe

C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
"C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tzutil /g
2⤵
- Suspicious use of WriteProcessMemory
PID:4272

memory/2980-133-0x0000000000660000-0x00000000010D4000-memory.dmp

Filesize
10.5MB

Download
memory/2980-137-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2980-140-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2980-151-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download