7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb

Resubmissions

29/11/2024, 17:23

241129-vyj5lsxpb1 10

17/03/2023, 23:30

230317-3g5c8aad76 6

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2023, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Documents-invoice-plan_032023.exe
Size

1.5MB
MD5

82acd827f36e29c05e6581558b0d76ca
SHA1

bd43089a78e97b66064b37d72f086f4c042a4c91
SHA256

7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb
SHA512

cdf9077fb0c06a9fc38dc0aa630345adfb65bfb264d03d7b56b0961f02798f8bce49fcfa28fd40671a02e1e385ac0c4c2a3f914b1d0b64a844462be2127b261f
SSDEEP

24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ipinfo.io
18	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 4176	2164	Documents-invoice-plan_032023.exe	86

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 448 wrote to memory of 220	448	cmd.exe	89
PID 448 wrote to memory of 220	448	cmd.exe	89
PID 448 wrote to memory of 220	448	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe
"C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe
  "C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tzutil /g
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\tzutil.exe
      tzutil /g
      4⤵
      PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-136-0x0000000004950000-0x0000000004A8D000-memory.dmp

Filesize
1.2MB

Download
memory/4176-134-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4176-137-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4176-144-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4176-150-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download