32dda6ee533d0c2c9ad0345a736af58af05d3b42fd380154a8f077d1598afb5d

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 22:11

Target

392661281a67df1b4124b3e476c24b7a.exe
Size

56KB
MD5

392661281a67df1b4124b3e476c24b7a
SHA1

ad8e39e264d5d7aabe763f473c8fa281306d9b1f
SHA256

32dda6ee533d0c2c9ad0345a736af58af05d3b42fd380154a8f077d1598afb5d
SHA512

865a159118b5811e07f598ac1e242f5ab125abc977e641fcfbc07e894cab3af1260b9299b4cd6eeb015bf17c9753688bc2735db4cd0933551b921bee0f2d6fe3
SSDEEP

768:0ME348Jtf85GpCg3RBDfuVPJDNx5cGCuYVq25kyFoE+BXeAxE:0MMvD37DwhP5cGCuYVq2yyFFH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3024	ekrakdeep.exe

Loads dropped DLL 1 IoCs

pid	Process
2840	392661281a67df1b4124b3e476c24b7a.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3024	2840	392661281a67df1b4124b3e476c24b7a.exe	28
PID 2840 wrote to memory of 3024	2840	392661281a67df1b4124b3e476c24b7a.exe	28
PID 2840 wrote to memory of 3024	2840	392661281a67df1b4124b3e476c24b7a.exe	28
PID 2840 wrote to memory of 3024	2840	392661281a67df1b4124b3e476c24b7a.exe	28

C:\Users\Admin\AppData\Local\Temp\392661281a67df1b4124b3e476c24b7a.exe
"C:\Users\Admin\AppData\Local\Temp\392661281a67df1b4124b3e476c24b7a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  2⤵
  - Executes dropped EXE
  PID:3024

\Users\Admin\AppData\Local\Temp\ekrakdeep.exe

Filesize
56KB

MD5
0399563b0654fb56e2c350dd9a6e145f

SHA1
18cb4398408676668f12b45903a15f76e1f40ae6

SHA256
9ac4a4375e210fbf4577b2a20185df0af5159a6671960dd21568eb7f82fbb702

SHA512
dc47d9dbc181ee3ae65efa838dd8725b3c1e46d1a3f8644515241a96397f3f97e34151a8b8e97c704ba42b8af427b7e8cd3ad0dbc8cdd4b67b546ee90cb7eb48

Download Submit
memory/2840-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2840-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2840-7-0x0000000000290000-0x000000000029D000-memory.dmp

Filesize
52KB

Download
memory/3024-8-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3024-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download