d8bede6d6a768342f477d73c042567ba054560223f698a901ab47139678ed983

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 07:21

Target

7ac279f39a89b938fdce639c2e7a1a40N.exe
Size

56KB
MD5

7ac279f39a89b938fdce639c2e7a1a40
SHA1

ef7c445be2753a8e39b5e983e5a3a0d323b3f552
SHA256

d8bede6d6a768342f477d73c042567ba054560223f698a901ab47139678ed983
SHA512

bb0318057f91137fb6e033de39957402d7edf797aa58f64e1a01cb93742f5f32f81e2ae187e6f003c769e56ff1405197cbd626126260852c2bd59defdfb96421
SSDEEP

768:MpMoXSRw9Cu/oVksMfTFWedUnV4fFhxRUSXOQ69zbjlAAX5e9z4b:kaACuk4oedUnV4fjPdizbR9Xwz6

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3020	cadvahin.exe

Loads dropped DLL 1 IoCs

pid	Process
560	7ac279f39a89b938fdce639c2e7a1a40N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3020	560	7ac279f39a89b938fdce639c2e7a1a40N.exe	29
PID 560 wrote to memory of 3020	560	7ac279f39a89b938fdce639c2e7a1a40N.exe	29
PID 560 wrote to memory of 3020	560	7ac279f39a89b938fdce639c2e7a1a40N.exe	29
PID 560 wrote to memory of 3020	560	7ac279f39a89b938fdce639c2e7a1a40N.exe	29

C:\Users\Admin\AppData\Local\Temp\7ac279f39a89b938fdce639c2e7a1a40N.exe
"C:\Users\Admin\AppData\Local\Temp\7ac279f39a89b938fdce639c2e7a1a40N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  2⤵
  - Executes dropped EXE
  PID:3020

\Users\Admin\AppData\Local\Temp\cadvahin.exe

Filesize
56KB

MD5
240a3a1a5b6e5703662b07e8b148fd7e

SHA1
28ea52eebd93b6502bd11c9259668cbbf287d0ea

SHA256
dd38e1553537d4fe3de269a4ba58244dd97f1fa41654bf17af616019ac917b8e

SHA512
1411819c5b8e0d89a2a4400dd28a575913ff28e9b772473a0336004cc5f22eb616783350370dcff19e61a0be913d08fe5a369b0b5a82f867dd16bcff47b1aed3

Download Submit
memory/560-1-0x0000000001281000-0x0000000001284000-memory.dmp

Filesize
12KB

Download
memory/3020-7-0x0000000000221000-0x0000000000224000-memory.dmp

Filesize
12KB

Download