ffeb57e7f334903e10bf3aa6177de7ef1e60abc1b1f41fd62270d462356dee2e

Analysis

max time kernel
144s
max time network
175s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 19:56

Target

NEAS.73413470c47184652e368557aae83830.exe
Size

97KB
MD5

73413470c47184652e368557aae83830
SHA1

e790c54254dbc7cac041a5c1a413c6fcf8959ccb
SHA256

ffeb57e7f334903e10bf3aa6177de7ef1e60abc1b1f41fd62270d462356dee2e
SHA512

ecd7c935e88945ea4171084d867b4ee0800c477e3d775a02a652ce94e53ba298aeb5721d3be947c8ab018a75653436a5da462aca35254ef717adc98b9464135f
SSDEEP

1536:2QxRQHgur/cgllYSNW2F6Q95xdZrqlrmVS3:BRQAuwQ95xdZri3

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1752	yokitoki.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	NEAS.73413470c47184652e368557aae83830.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2252-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2252-1-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/files/0x000a00000001226e-3.dat	upx
behavioral1/memory/1752-7-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/files/0x000a00000001226e-6.dat	upx
behavioral1/files/0x000a00000001226e-8.dat	upx
behavioral1/memory/1752-9-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1752	2252	NEAS.73413470c47184652e368557aae83830.exe	28
PID 2252 wrote to memory of 1752	2252	NEAS.73413470c47184652e368557aae83830.exe	28
PID 2252 wrote to memory of 1752	2252	NEAS.73413470c47184652e368557aae83830.exe	28
PID 2252 wrote to memory of 1752	2252	NEAS.73413470c47184652e368557aae83830.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.73413470c47184652e368557aae83830.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.73413470c47184652e368557aae83830.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\yokitoki.exe
  C:\Users\Admin\AppData\Local\Temp\yokitoki.exe
  2⤵
  - Executes dropped EXE
  PID:1752

C:\Users\Admin\AppData\Local\Temp\yokitoki.exe

Filesize
97KB

MD5
2d4e9f8307029a65b16a55131f0846dd

SHA1
5394eeb42837e6b3675b09a68243c579c8681e87

SHA256
6ec5adbb7d21b017927b15bf82977bc50fb11f3940edf968d734439c34339a3f

SHA512
3b0eceaeab4a77e4d7f68c839ef40efdfa90923d09532a5781d1e5149d2ed6f8e27c8c810530b8d7365fa182f91922335d35b0a28157045149368004a2832c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\yokitoki.exe

Filesize
97KB

MD5
2d4e9f8307029a65b16a55131f0846dd

SHA1
5394eeb42837e6b3675b09a68243c579c8681e87

SHA256
6ec5adbb7d21b017927b15bf82977bc50fb11f3940edf968d734439c34339a3f

SHA512
3b0eceaeab4a77e4d7f68c839ef40efdfa90923d09532a5781d1e5149d2ed6f8e27c8c810530b8d7365fa182f91922335d35b0a28157045149368004a2832c29

Download Submit
\Users\Admin\AppData\Local\Temp\yokitoki.exe

Filesize
97KB

MD5
2d4e9f8307029a65b16a55131f0846dd

SHA1
5394eeb42837e6b3675b09a68243c579c8681e87

SHA256
6ec5adbb7d21b017927b15bf82977bc50fb11f3940edf968d734439c34339a3f

SHA512
3b0eceaeab4a77e4d7f68c839ef40efdfa90923d09532a5781d1e5149d2ed6f8e27c8c810530b8d7365fa182f91922335d35b0a28157045149368004a2832c29

Download Submit
memory/1752-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1752-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2252-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2252-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download