a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:35

Target

a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe
Size

68KB
MD5

608165477e94424c6aa710ba97699120
SHA1

d444e19510f7c36c63c4d7a05cfd72cc89cca17c
SHA256

a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7
SHA512

731cc00f9deb5172bde125e98fc83cf413041aad5cebc34f3c049087732353eba19cacdab30d188029384fc388c2a993207e1bce5e8ed4c435d9c1604422adcc
SSDEEP

1536:0MoH2Qem7YY7mRwkcDxohVOQRUUUUUAvpuQ410nsWLo:tkRYeBDxohVZ7uQ4Lso

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5096	olacweegim.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 5096	680	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	82
PID 680 wrote to memory of 5096	680	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	82
PID 680 wrote to memory of 5096	680	a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe	82

C:\Users\Admin\AppData\Local\Temp\a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe
"C:\Users\Admin\AppData\Local\Temp\a4053bebd12edae3fecba650fe260860d9ed9859f033cd7f58fb9575599a9cc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:5096

C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
68KB

MD5
8fdb3f7aeb76efa15b332cfdd65ba258

SHA1
95d2644490c856b871b9d614073fd506c84e5926

SHA256
dd34c626b351e5eb271aa26ac4991baba002105e42622c4d39d68be13f91b519

SHA512
67ba67c1d7277c61c2d01badcb9eb6b1bb43876b41863214ceaaa1182806205351d5533020986580daaeaf8d8a928ddb462028d89c210aa8437fc3609bfa8f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
68KB

MD5
8fdb3f7aeb76efa15b332cfdd65ba258

SHA1
95d2644490c856b871b9d614073fd506c84e5926

SHA256
dd34c626b351e5eb271aa26ac4991baba002105e42622c4d39d68be13f91b519

SHA512
67ba67c1d7277c61c2d01badcb9eb6b1bb43876b41863214ceaaa1182806205351d5533020986580daaeaf8d8a928ddb462028d89c210aa8437fc3609bfa8f35

Download Submit
memory/680-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5096-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download