b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:11

Target

b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe
Size

71KB
MD5

3f6cb00822916f09df16c8db35f72ff5
SHA1

a606b77187f686f896dfa3ba06b479e6a1f29cd8
SHA256

b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715
SHA512

62d03f717c8b69dc062a2616cb7755e8874293b4b8171c9a9ccb1eaac37bb58a32b92850e3ae54f207f621cd957d5291b2889d4a2f42d0f3598177c45539d998
SSDEEP

1536:HahGy7fReZKteO2R/SfVkXb+obLalWGgcd7:8HjR5cO2Sqb+odGgo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2220	vabkemar.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2220	2244	b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe	28
PID 2244 wrote to memory of 2220	2244	b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe	28
PID 2244 wrote to memory of 2220	2244	b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe	28
PID 2244 wrote to memory of 2220	2244	b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe	28

C:\Users\Admin\AppData\Local\Temp\b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe
"C:\Users\Admin\AppData\Local\Temp\b8c063587c8a0dc7fb375828ea7ebc387079a8761a63a5232ff905c5d896a715.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\vabkemar.exe
  C:\Users\Admin\AppData\Local\Temp\vabkemar.exe
  2⤵
  - Executes dropped EXE
  PID:2220

\Users\Admin\AppData\Local\Temp\vabkemar.exe

Filesize
71KB

MD5
8ba74c95a7b5acbe8cad0d1b81189a48

SHA1
cf7eb902c64bb58ddbf095c8a051292dce41b83d

SHA256
d420589875266f2fa1eec3bb9339b73ad2661324784caa68e94c9fd7e818dd03

SHA512
8d99c41ac0cede4cbf6a56910458de65ec375adc2e78556506f0480ee205b865c0855f0b260b1ab8cad60d6473d77510f91f2a21307aac55597b517f02cf3c24

Download Submit
memory/2220-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2244-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2244-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download