a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e

Analysis

max time kernel
129s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:31

Target

a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Size

145KB
MD5

5647d4670bf453ea46b04b70cee2eb41
SHA1

9cff36e41153665ca479950133b9521a850ceee5
SHA256

a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
SHA512

d27f7d110ffd521c9a144c99c62a5fce6b1c3956a11edf2e3160f28dc4ac40c3a32953d2d2f66f6b855195426ea35282d94cd20ce0cf8c947e39119bf3ada26a
SSDEEP

1536:0MvKGF80crNopDaPsDHtcGquYVnPKp4ZAk3rf:tvvj00DaEDAuYFPJZAG

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1372-0-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/1372-1-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/files/0x000b0000000141a2-7.dat	UPX
behavioral1/memory/2988-8-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral1/memory/2988-10-0x0000000000400000-0x0000000000424000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2988	ekrakdeep.exe

Loads dropped DLL 1 IoCs

pid	Process
1372	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1372-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1372-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/files/0x000b0000000141a2-7.dat	upx
behavioral1/memory/2988-8-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2988-10-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2988	1372	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	28
PID 1372 wrote to memory of 2988	1372	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	28
PID 1372 wrote to memory of 2988	1372	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	28
PID 1372 wrote to memory of 2988	1372	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	28

C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
"C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  2⤵
  - Executes dropped EXE
  PID:2988

C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe

Filesize
145KB

MD5
8ad1aeba150342ee01c62217b451dda5

SHA1
19dd0cfdb52669f323b8dc7e661bbf9883873e0c

SHA256
2eac49f28caa284a55ec47f5ca2abb6f65884e93b5a0cdb398642a439222a145

SHA512
694a94e4c624dc8caeb8527e91a98d20498f6b087922d54090b3e8368711c720ff1222b25980bed88c08977b9ccb8c3fcfc7cb7ccac231698d82acaacc9f86f4

Download Submit
memory/1372-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1372-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1372-6-0x0000000000260000-0x0000000000284000-memory.dmp

Filesize
144KB

Download
memory/2988-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2988-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download