1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 16:04

Sharing

Target

Archive.zip__ccacaxs2tbz2t6ob3e.exe
Size

430KB
MD5

a3cab1a43ff58b41f61f8ea32319386b
SHA1

94689e1a9e1503f1082b23e6d5984d4587f3b9ec
SHA256

005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6
SHA512

8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d
SSDEEP

6144:vU9Q9tD5WuDQa4t3BMgLkzvCOnYxcEaSAOPou8BWinO8DR:8Q9tD5WyQlBBVAnYxRhr8DR

Score

8^/10

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

7426.tmp.exe

pid process

4936 7426.tmp.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

11 iplogger.org
13 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com

pid	process
4936	7426.tmp.exe

flow	ioc
11	iplogger.org
13	iplogger.org

flow	ioc
21	ip-api.com

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Archive.zip__ccacaxs2tbz2t6ob3e.exe

description	pid	process	target process
PID 3448 wrote to memory of 4936	3448	Archive.zip__ccacaxs2tbz2t6ob3e.exe	7426.tmp.exe
PID 3448 wrote to memory of 4936	3448	Archive.zip__ccacaxs2tbz2t6ob3e.exe	7426.tmp.exe
PID 3448 wrote to memory of 4936	3448	Archive.zip__ccacaxs2tbz2t6ob3e.exe	7426.tmp.exe

C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
"C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Users\Admin\AppData\Local\Temp\7426.tmp.exe
C:\Users\Admin\AppData\Local\Temp\7426.tmp.exe
2⤵
- Executes dropped EXE
PID:4936

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\7426.tmp.exe
Filesize
149KB

MD5
060404f288040959694844afbd102966

SHA1
e0525e9ef6713fd7f269a669335ce3ddaab4b6a1

SHA256
40517e822f3442a2f389a50e905f40a6a2c4930077c865e3ea7b1929405f760a

SHA512
ddf8c53e1e1888084fa5422f297cc3ba9d97f7576c36f6b633ce67ca789127f7e259e9fb374fcbced66f883dadde0717d81ecce9776770bf07d8cf3b94b1a43f

Download Submit