d9bf9211b0f25e94387aefe0dcb6a982b8df57abeb485df14e01752c7d340bfc

Resubmissions

29-11-2024 17:23

26-07-2023 14:53

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2023 14:53

Target

lllll.bin.exe
Size

2.4MB
MD5

708845c87ffabe9b8c59501511640be7
SHA1

a72747b1d9b00a2a33085ad49d25976c1ecc2311
SHA256

d9bf9211b0f25e94387aefe0dcb6a982b8df57abeb485df14e01752c7d340bfc
SHA512

1538af2ae8db0b49d505c5bffcf658c5cd7e9d41eef397a9d81ea681db6e206a2e15f69d3dca6b6d04004b945ea64bde40b7f3bb9574ae17c0342ac78db25f6f
SSDEEP

49152:huxIPf1+yc55pMLPTVcTI4lMzoBq/lFQjYSgOUGhbIzhirApV5:oUf655a6TLeoBq/lFQjYSgOUGhbIzhiI

Score

6^/10

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
18	ipinfo.io

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3732	lllll.bin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3024	3732	lllll.bin.exe	86
PID 3732 wrote to memory of 3024	3732	lllll.bin.exe	86
PID 3732 wrote to memory of 3024	3732	lllll.bin.exe	86
PID 3024 wrote to memory of 324	3024	cmd.exe	88
PID 3024 wrote to memory of 324	3024	cmd.exe	88
PID 3024 wrote to memory of 324	3024	cmd.exe	88

memory/3732-133-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/3732-134-0x0000000002DA0000-0x0000000002EE7000-memory.dmp

Filesize
1.3MB

Download
memory/3732-158-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download