23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 18:23

Target

23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe
Size

50KB
MD5

a0244af81614c367388b4127d4de7d1f
SHA1

d707fa7d9c02e44149c889f1137c16204d25c5b1
SHA256

23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641
SHA512

71147292f2a1cdf549feac1aea14bb9cd03ba32e2c2f073e350872e37456eab6a06313d78b28f9f17561e27bd85516be2b3a01c5d2fccebc0d2aadd37d035195
SSDEEP

768:s+pWrOOfbMUI4ybFrcUtxLKxouHd5slovvlLuzTUNhOPSAl45TciZ:s+pWrvI+UFrjxWxo45slovteYk6RTciZ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2388	dylkemi.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe
2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2388	2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe	28
PID 2368 wrote to memory of 2388	2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe	28
PID 2368 wrote to memory of 2388	2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe	28
PID 2368 wrote to memory of 2388	2368	23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe	28

C:\Users\Admin\AppData\Local\Temp\23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe
"C:\Users\Admin\AppData\Local\Temp\23ade10db3a9b8783ac90a7b4c78aac102bd6331c6649f1c90bff24f7de3b641.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\dylkemi.exe
  C:\Users\Admin\AppData\Local\Temp\dylkemi.exe
  2⤵
  - Executes dropped EXE
  PID:2388

C:\Users\Admin\AppData\Local\Temp\dylkemi.exe

Filesize
50KB

MD5
b3a690662ce69749f2229a92d032ecf4

SHA1
7f341772e24dd4f0749dcd892a462e2fbb34a7d7

SHA256
df470c8b2e3e9884c95047091ce96d2dd95e7df941ff45a54ccec005fdaf1248

SHA512
b7ddd3695cb9890f28d291b913dadd2c6ad6d2ea0b1e350d0c0731796dcbc744bc09f64de5fac6746a7f56db0aa9774f30540c86bb237e24cdff8c71473b21b0

Download Submit
memory/2368-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2388-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download