a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 01:31

Target

a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
Size

145KB
MD5

5647d4670bf453ea46b04b70cee2eb41
SHA1

9cff36e41153665ca479950133b9521a850ceee5
SHA256

a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e
SHA512

d27f7d110ffd521c9a144c99c62a5fce6b1c3956a11edf2e3160f28dc4ac40c3a32953d2d2f66f6b855195426ea35282d94cd20ce0cf8c947e39119bf3ada26a
SSDEEP

1536:0MvKGF80crNopDaPsDHtcGquYVnPKp4ZAk3rf:tvvj00DaEDAuYFPJZAG

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/2976-0-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/2976-2-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/files/0x000b000000023bc2-5.dat	UPX
behavioral2/memory/688-6-0x0000000000400000-0x0000000000424000-memory.dmp	UPX
behavioral2/memory/688-7-0x0000000000400000-0x0000000000424000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
688	ekrakdeep.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2976-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2976-2-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/files/0x000b000000023bc2-5.dat	upx
behavioral2/memory/688-6-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/688-7-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 688	2976	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	84
PID 2976 wrote to memory of 688	2976	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	84
PID 2976 wrote to memory of 688	2976	a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe	84

C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe
"C:\Users\Admin\AppData\Local\Temp\a32ed8cec9861b86954baf4811a4c469eb9434015bf6ad6bbfec6226c313581e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe
  2⤵
  - Executes dropped EXE
  PID:688

C:\Users\Admin\AppData\Local\Temp\ekrakdeep.exe

Filesize
145KB

MD5
8ad1aeba150342ee01c62217b451dda5

SHA1
19dd0cfdb52669f323b8dc7e661bbf9883873e0c

SHA256
2eac49f28caa284a55ec47f5ca2abb6f65884e93b5a0cdb398642a439222a145

SHA512
694a94e4c624dc8caeb8527e91a98d20498f6b087922d54090b3e8368711c720ff1222b25980bed88c08977b9ccb8c3fcfc7cb7ccac231698d82acaacc9f86f4

Download Submit
memory/688-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/688-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2976-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2976-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download