dc2b7679fe1950b3fd5d72668e957484b24c169dadc0ddbe69334e748ae197a6

Analysis

max time kernel
121s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:50

Target

e27602f250feafb8c2dc9a04e5ba2137.exe
Size

1.0MB
MD5

e27602f250feafb8c2dc9a04e5ba2137
SHA1

67250b69ab12c0f539fe4c7f2a0ec7f30cce50b6
SHA256

dc2b7679fe1950b3fd5d72668e957484b24c169dadc0ddbe69334e748ae197a6
SHA512

962d5e64905693379b9ef128657d15815fae31b3743639d411c09162251ed28ec685edcebb6ebe099dc7469b068e4827b44de25de99b29478c564eda94aaba09
SSDEEP

24576:afQY6fhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRPIM:bo54clgLH+tkWJ0N5

Score

6^/10

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e27602f250feafb8c2dc9a04e5ba2137.exe

description pid process

Token: SeDebugPrivilege 2604 e27602f250feafb8c2dc9a04e5ba2137.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2604	e27602f250feafb8c2dc9a04e5ba2137.exe

C:\Users\Admin\AppData\Local\Temp\e27602f250feafb8c2dc9a04e5ba2137.exe
"C:\Users\Admin\AppData\Local\Temp\e27602f250feafb8c2dc9a04e5ba2137.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604

memory/2604-0-0x0000000000D30000-0x0000000000E3A000-memory.dmp

Filesize
1.0MB

Download
memory/2604-1-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download
memory/2604-2-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download
memory/2604-3-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2604-4-0x0000000000500000-0x0000000000576000-memory.dmp

Filesize
472KB

Download
memory/2604-5-0x000007FEF5C00000-0x000007FEF65EC000-memory.dmp

Filesize
9.9MB

Download