e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843

Analysis

max time kernel
147s
max time network
160s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 01:11

Target

e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe
Size

52KB
MD5

d3b1b70fad55f362c3ee15d919795331
SHA1

0804914b2eb1dca23c2b8d29b2250f693ee249e9
SHA256

e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843
SHA512

8da4ebfecc4ab367de86d6c1be1464663c671aa7f95d16a3e68d06fc064f100242e9ddc7f8e6927ed58ee3ffe42ef1526f01870cfa61c64bcbd70b512e861117
SSDEEP

1536:hikeKhs7PNZvInXqdWbh8UH9SZ47Qn/uHoZ:fxhyfARH9SZ4uuIZ

Score

9^/10

Detects executables built or packed with MPress PE compressor 6 IoCs

resource	yara_rule
behavioral1/memory/2836-0-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2836-2-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0009000000012246-3.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2404-8-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2836-7-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2404-10-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2404	olacweegim.exe

Loads dropped DLL 1 IoCs

pid	Process
2836	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2404	2836	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	28
PID 2836 wrote to memory of 2404	2836	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	28
PID 2836 wrote to memory of 2404	2836	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	28
PID 2836 wrote to memory of 2404	2836	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	28

C:\Users\Admin\AppData\Local\Temp\e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe
"C:\Users\Admin\AppData\Local\Temp\e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:2404

\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
52KB

MD5
1c354c65dcb6eb765ee0490f36ce5dac

SHA1
a2b752e60bff9cd1848585eb8e4b031a6bcceca1

SHA256
244e659dc565dcfebad18448a9044568432b6962b4f38f343f3cbbb92ee04ead

SHA512
37ce3fa155b0d7226cb10defefb4b5753cbe6e2d99cab82521cff9f87aad030e782e18c6209dacef559b0b5950f4b0f129a0a82cb9a9c885f55313ec436e56f0

Download Submit
memory/2404-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2404-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2836-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2836-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2836-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download