b4165bc4108e758c752a1874e80bf6c5aa53264456ffa6a7da23080db055caf1 | Triage

Analysis

max time kernel
114s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

klasdadkapasdasd.exe
Size

7.8MB
MD5

bd5d39e8f5fe6a20126dfb7a023db746
SHA1

e3f3dba155903117edf707f8886527093ea5e1ec
SHA256

b4165bc4108e758c752a1874e80bf6c5aa53264456ffa6a7da23080db055caf1
SHA512

e3014dac1ee9027925ae0af2f8a5f7616d4cd346d39e4f9204cf635a36497c50134f166926e42205e8b0117c15c9783c922090597b95bca89721c81c358e4efb
SSDEEP

49152:8HGecOpEfi6eSXVeSfDbu90zjoBGHExfLJJ785C5YVo03Pu:8/zkDHHukoB9xD85hF3Pu

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2976	klasdadkapasdasd.exe
2976	klasdadkapasdasd.exe
2976	klasdadkapasdasd.exe
2976	klasdadkapasdasd.exe

C:\Users\Admin\AppData\Local\Temp\klasdadkapasdasd.exe
"C:\Users\Admin\AppData\Local\Temp\klasdadkapasdasd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1424,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
1⤵
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/2976-1-0x00000000000B0000-0x0000000000887000-memory.dmp

Filesize
7.8MB

Download