0966d80a92f4d703953821c4568ff25e0e5a984957c8d1789cad5e22e498bd6f

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 07:33

Target

HEUR-Trojan.Win32.exe
Size

72KB
MD5

090c8d0aa55c4d19d4577957b6db2b44
SHA1

8e7a9231aa8e2d47055d5212fc997b93cb4e35eb
SHA256

0966d80a92f4d703953821c4568ff25e0e5a984957c8d1789cad5e22e498bd6f
SHA512

4c8914f1609f7b852471f5399efb47341a8175c6d89742084238c934a9fe282f1a4b4619a3fe1d436be644b3c9fe0ee19ed6915ea82af6d5b279a1eb2d2a1895
SSDEEP

1536:Itka3G9MXSRa+ycuCRo0oxNqIxSupVvIC74zbW:Qka29MXZxIY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1736	bijaweed.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	HEUR-Trojan.Win32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1736	2000	HEUR-Trojan.Win32.exe	27
PID 2000 wrote to memory of 1736	2000	HEUR-Trojan.Win32.exe	27
PID 2000 wrote to memory of 1736	2000	HEUR-Trojan.Win32.exe	27
PID 2000 wrote to memory of 1736	2000	HEUR-Trojan.Win32.exe	27

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\bijaweed.exe
  C:\Users\Admin\AppData\Local\Temp\bijaweed.exe
  2⤵
  - Executes dropped EXE
  PID:1736

C:\Users\Admin\AppData\Local\Temp\bijaweed.exe

Filesize
64KB

MD5
051253d6979fde811365154bff56e16b

SHA1
d86988b426c04c578b3fb393235a85153c827b84

SHA256
6aff28fc8732f4591a9d2be6c49d64d1ff67845d7706e688c9af1514fb61350a

SHA512
b885a1df282601a54930fe995278d1184365779e247980084149d9eb48c33b850b62bd2460339b802ca5581a8455bee5596ee216b2bb7b8109564aceb2042053

Download Submit
\Users\Admin\AppData\Local\Temp\bijaweed.exe

Filesize
72KB

MD5
90f5414b60c36618baa7b7d4e0c19011

SHA1
70a6b6c09938be972f39f4590dc580c933f189d4

SHA256
fe8addb7fd0afe166852b56bb7b3bc9697bc7a33dc7ac12767381a71a5865b87

SHA512
8477f7e49f77371dce7ad30c60b229fa71c43a728dfc8af6b100fd2110b4b405d8e6d7406e735ebdc482c9ca0eefe96d6cc05fdeaa3960227bca5cfd16295e74

Download Submit
memory/1736-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2000-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download