0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 18:37

Target

0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe
Size

34KB
MD5

535ab245ee310081977cadd7f14865e3
SHA1

58b3e668766f6beda6d2bdeb03028823ea980b5e
SHA256

0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b
SHA512

6a65f8d3b2d69502660036ba3f4bdb95f1e96362f98bd532530a70b98179fab16cd25492bab1cd90cff6ba7cc5c036b40cd952c6f8cb891be968cee8366b8753
SSDEEP

384:0Mny9+o5r7DF3HgecDtoKlGyBHv06iGDA4OQezSNH3QdLew5ejinMi9:0My9Xt/FY7VVZHMSNHiaw5lnN9

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2148	ofylywo.exe

Loads dropped DLL 1 IoCs

pid	Process
2708	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2708-0-0x0000000000270000-0x0000000000284000-memory.dmp	upx
behavioral1/files/0x0007000000012119-8.dat	upx
behavioral1/memory/2148-9-0x00000000012A0000-0x00000000012B4000-memory.dmp	upx
behavioral1/memory/2708-7-0x0000000000270000-0x0000000000284000-memory.dmp	upx
behavioral1/memory/2148-12-0x00000000012A0000-0x00000000012B4000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2148	2708	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	30
PID 2708 wrote to memory of 2148	2708	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	30
PID 2708 wrote to memory of 2148	2708	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	30
PID 2708 wrote to memory of 2148	2708	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	30

C:\Users\Admin\AppData\Local\Temp\0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe
"C:\Users\Admin\AppData\Local\Temp\0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:2148

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
34KB

MD5
da82f634ff7e40674b7272dc185d6f9d

SHA1
e81fd06b3c186684cf1c1a8390927b6f1015db2e

SHA256
30901c478e4147830132f1349e85f6956ebc41f5af6da2bcf20a9deba70bb0f1

SHA512
42fc6c9fc03bc62981b27881fab8c2ddc8bd91012d10ffcbdaaa29e93e68e2d3aa010f6c2548d2ae5b38664ab962dcc7119b389885f2326ff99a843e89eac981

Download Submit
memory/2148-9-0x00000000012A0000-0x00000000012B4000-memory.dmp

Filesize
80KB

Download
memory/2148-11-0x00000000012A1000-0x00000000012A3000-memory.dmp

Filesize
8KB

Download
memory/2148-12-0x00000000012A0000-0x00000000012B4000-memory.dmp

Filesize
80KB

Download
memory/2708-0-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/2708-5-0x0000000000271000-0x0000000000273000-memory.dmp

Filesize
8KB

Download
memory/2708-7-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download