0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:37

Target

0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe
Size

34KB
MD5

535ab245ee310081977cadd7f14865e3
SHA1

58b3e668766f6beda6d2bdeb03028823ea980b5e
SHA256

0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b
SHA512

6a65f8d3b2d69502660036ba3f4bdb95f1e96362f98bd532530a70b98179fab16cd25492bab1cd90cff6ba7cc5c036b40cd952c6f8cb891be968cee8366b8753
SSDEEP

384:0Mny9+o5r7DF3HgecDtoKlGyBHv06iGDA4OQezSNH3QdLew5ejinMi9:0My9Xt/FY7VVZHMSNHiaw5lnN9

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1776	ofylywo.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000C40000-0x0000000000C54000-memory.dmp	upx
behavioral2/files/0x0006000000023248-4.dat	upx
behavioral2/memory/1776-5-0x00000000005F0000-0x0000000000604000-memory.dmp	upx
behavioral2/memory/4868-7-0x0000000000C40000-0x0000000000C54000-memory.dmp	upx
behavioral2/memory/1776-10-0x00000000005F0000-0x0000000000604000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1776	4868	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	83
PID 4868 wrote to memory of 1776	4868	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	83
PID 4868 wrote to memory of 1776	4868	0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe	83

C:\Users\Admin\AppData\Local\Temp\0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe
"C:\Users\Admin\AppData\Local\Temp\0bb48e66459cedaf7ef990cf2031c2b9e6f4cd1c18d2186aa982b5f027d01b6b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:1776

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
34KB

MD5
da82f634ff7e40674b7272dc185d6f9d

SHA1
e81fd06b3c186684cf1c1a8390927b6f1015db2e

SHA256
30901c478e4147830132f1349e85f6956ebc41f5af6da2bcf20a9deba70bb0f1

SHA512
42fc6c9fc03bc62981b27881fab8c2ddc8bd91012d10ffcbdaaa29e93e68e2d3aa010f6c2548d2ae5b38664ab962dcc7119b389885f2326ff99a843e89eac981

Download Submit
memory/1776-5-0x00000000005F0000-0x0000000000604000-memory.dmp

Filesize
80KB

Download
memory/1776-9-0x00000000005F1000-0x00000000005F3000-memory.dmp

Filesize
8KB

Download
memory/1776-10-0x00000000005F0000-0x0000000000604000-memory.dmp

Filesize
80KB

Download
memory/4868-0-0x0000000000C40000-0x0000000000C54000-memory.dmp

Filesize
80KB

Download
memory/4868-1-0x0000000000C41000-0x0000000000C43000-memory.dmp

Filesize
8KB

Download
memory/4868-7-0x0000000000C40000-0x0000000000C54000-memory.dmp

Filesize
80KB

Download