a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:35

Target

a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe
Size

68KB
MD5

608165477e94424c6aa710ba97699120
SHA1

d444e19510f7c36c63c4d7a05cfd72cc89cca17c
SHA256

a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7
SHA512

731cc00f9deb5172bde125e98fc83cf413041aad5cebc34f3c049087732353eba19cacdab30d188029384fc388c2a993207e1bce5e8ed4c435d9c1604422adcc
SSDEEP

1536:0MoH2Qem7YY7mRwkcDxohVOQRUUUUUAvpuQ410nsWLo:tkRYeBDxohVZ7uQ4Lso

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1516	olacweegim.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1516	2020	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	26
PID 2020 wrote to memory of 1516	2020	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	26
PID 2020 wrote to memory of 1516	2020	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	26
PID 2020 wrote to memory of 1516	2020	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	26

C:\Users\Admin\AppData\Local\Temp\a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe
"C:\Users\Admin\AppData\Local\Temp\a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:1516

C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
68KB

MD5
8fdb3f7aeb76efa15b332cfdd65ba258

SHA1
95d2644490c856b871b9d614073fd506c84e5926

SHA256
dd34c626b351e5eb271aa26ac4991baba002105e42622c4d39d68be13f91b519

SHA512
67ba67c1d7277c61c2d01badcb9eb6b1bb43876b41863214ceaaa1182806205351d5533020986580daaeaf8d8a928ddb462028d89c210aa8437fc3609bfa8f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
68KB

MD5
8fdb3f7aeb76efa15b332cfdd65ba258

SHA1
95d2644490c856b871b9d614073fd506c84e5926

SHA256
dd34c626b351e5eb271aa26ac4991baba002105e42622c4d39d68be13f91b519

SHA512
67ba67c1d7277c61c2d01badcb9eb6b1bb43876b41863214ceaaa1182806205351d5533020986580daaeaf8d8a928ddb462028d89c210aa8437fc3609bfa8f35

Download Submit
\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
68KB

MD5
8fdb3f7aeb76efa15b332cfdd65ba258

SHA1
95d2644490c856b871b9d614073fd506c84e5926

SHA256
dd34c626b351e5eb271aa26ac4991baba002105e42622c4d39d68be13f91b519

SHA512
67ba67c1d7277c61c2d01badcb9eb6b1bb43876b41863214ceaaa1182806205351d5533020986580daaeaf8d8a928ddb462028d89c210aa8437fc3609bfa8f35

Download Submit
memory/1516-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1516-60-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download