7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb

Resubmissions

29/11/2024, 17:23

241129-vyj5lsxpb110

17/03/2023, 23:30

230317-3g5c8aad766

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2023, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Documents-invoice-plan_032023.exe
Size 1.5MB
Sample230317-3g5c8aad76
SHA256 7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb
MD5 82acd827f36e29c05e6581558b0d76ca
SHA1 bd43089a78e97b66064b37d72f086f4c042a4c91
SHA512 cdf9077fb0c06a9fc38dc0aa630345adfb65bfb264d03d7b56b0961f02798f8bce49fcfa28fd40671a02e1e385ac0c4c2a3f914b1d0b64a844462be2127b261f
SSDEEP 24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ipinfo.io
18	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 4176	2164	Documents-invoice-plan_032023.exe	86

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 2164 wrote to memory of 4176	2164	Documents-invoice-plan_032023.exe	86
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 4176 wrote to memory of 448	4176	Documents-invoice-plan_032023.exe	87
PID 448 wrote to memory of 220	448	cmd.exe	89
PID 448 wrote to memory of 220	448	cmd.exe	89
PID 448 wrote to memory of 220	448	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe
"C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe
  "C:\Users\Admin\AppData\Local\Temp\Documents-invoice-plan_032023.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tzutil /g
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\tzutil.exe
      tzutil /g
      4⤵
      PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-136-0x0000000004950000-0x0000000004A8D000-memory.dmp

Download

memory/4176-134-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4176-137-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4176-144-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4176-150-0x0000000000400000-0x0000000000545000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads