596263884d5474c2d3bb01238718eb30ce2c8539c99f66fa26b92171c6786c26

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Size

659KB
MD5

b3dc48d13f7d541fa583bf964c0603bf
SHA1

1dbaa68adc0a592508f7ad715bfcdf79c17990d6
SHA256

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7
SHA512

193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4
SSDEEP

12288:JR2N+L3K6boxK6dSmiTwntcm3Kbjbgv8YXoNCMF6+yWiL4Wlsfppj4W:P8+L3UM6SIcsHj4N5F6+yW/W4XP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

pid process

1396 a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2308 a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

55 myexternalip.com

pid	process
1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2308	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

flow	ioc
55	myexternalip.com

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exea2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe

description	pid	process	target process
PID 2028 wrote to memory of 1396	2028	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 2028 wrote to memory of 1396	2028	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 2028 wrote to memory of 1396	2028	b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe
PID 1396 wrote to memory of 1700	1396	a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\lab_samples\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
"C:\Users\Admin\AppData\Local\Temp\lab_samples\b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SYSTEM32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:1700

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
2⤵
PID:3244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winapp\a2a2aa408cc23a822a0a8810ea804dbaa4bd21b23760a18a4712a4a0ec3c8eb6.exe
Filesize
659KB

MD5
b3dc48d13f7d541fa583bf964c0603bf

SHA1
1dbaa68adc0a592508f7ad715bfcdf79c17990d6

SHA256
b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7

SHA512
193bda0656a9d1be54dc655d9af3224ddccb78fc26aa77618fba1e3c36005a0368a200960cc28facc280df667f51a26bbef62282bbf8837cc036a41bfb8525f4

Download Submit
memory/1396-19-0x0000000002760000-0x000000000281E000-memory.dmp

Filesize
760KB

Download
memory/1396-20-0x0000000002820000-0x0000000002AE9000-memory.dmp

Filesize
2.8MB

Download
memory/1396-18-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1396-21-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1396-9-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1396-10-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1396-11-0x0000000002250000-0x000000000228C000-memory.dmp

Filesize
240KB

Download
memory/1396-12-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1700-22-0x000002C6DAC10000-0x000002C6DAC11000-memory.dmp

Filesize
4KB

Download
memory/1700-23-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1700-17-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/2028-1-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2028-2-0x0000000002340000-0x000000000237C000-memory.dmp

Filesize
240KB

Download
memory/2028-4-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2028-0-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2308-46-0x0000000000D20000-0x0000000000DDE000-memory.dmp

Filesize
760KB

Download
memory/2308-33-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2308-45-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2308-47-0x00000000013B0000-0x0000000001679000-memory.dmp

Filesize
2.8MB

Download
memory/3244-50-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download