42f6ed3f3f25e52787a9e43dec53306eb63e581d87882f3fbc4756685714e39a

Resubmissions

07/01/2024, 18:26

max time kernel
186s
max time network
367s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 18:26

Target

Samples 6/c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe
Size

92KB
MD5

e63a11b2e2e6bcfa68011a56ac95bcbb
SHA1

3a43758c8f5bf1fd80b44d7dca6adaebd242ce59
SHA256

c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b
SHA512

03bdecf2da756f32b7a19ca36cb0b272a15357fd0b1b124268400606aaea9c99e65ed440933c11ccc44a506aba50941f2afcb2fafab75979feb703a8b4e91bb7
SSDEEP

1536:f9HMlaocok7dJK4Rm7mUBAMs0q4gF693F7hmE5hOy:f9H75dJKWohBAMs0qC7

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4492	yaxkodila.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
91	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4492	4512	c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe	90
PID 4512 wrote to memory of 4492	4512	c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe	90
PID 4512 wrote to memory of 4492	4512	c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe	90

C:\Users\Admin\AppData\Local\Temp\Samples 6\c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 6\c808c7043bbe6f22fdae5e9ad031db55e2ec385489a53ad3096985e53292244b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\yaxkodila.exe
  C:\Users\Admin\AppData\Local\Temp\yaxkodila.exe
  2⤵
  - Executes dropped EXE
  PID:4492

C:\Users\Admin\AppData\Local\Temp\yaxkodila.exe

Filesize
92KB

MD5
60c7652c22ee1456c3d1a0c16fa3686b

SHA1
3c82843a4ac73b8b0360b73a85eb7ef7721d192b

SHA256
89e569854fec453eef950384b8e0829287d2b0ef89b4afd20099ab5277edf179

SHA512
e0ced0d86f01d782853ff0d3e4edf9a87c129a040ebc6ed0025b31ab26af7e0236a52674721613928f990ca455f2d2a3448cd05a805852f4c0b5079cbc699d05

Download Submit
memory/4492-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4512-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4512-1-0x0000000001F00000-0x0000000001F07000-memory.dmp

Filesize
28KB

Download
memory/4512-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4512-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download