e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 01:11

Target

e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe
Size

52KB
MD5

d3b1b70fad55f362c3ee15d919795331
SHA1

0804914b2eb1dca23c2b8d29b2250f693ee249e9
SHA256

e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843
SHA512

8da4ebfecc4ab367de86d6c1be1464663c671aa7f95d16a3e68d06fc064f100242e9ddc7f8e6927ed58ee3ffe42ef1526f01870cfa61c64bcbd70b512e861117
SSDEEP

1536:hikeKhs7PNZvInXqdWbh8UH9SZ47Qn/uHoZ:fxhyfARH9SZ4uuIZ

Score

9^/10

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4456-1-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000022745-5.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4456-6-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1108-7-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1108	olacweegim.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1108	4456	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	90
PID 4456 wrote to memory of 1108	4456	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	90
PID 4456 wrote to memory of 1108	4456	e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe	90

C:\Users\Admin\AppData\Local\Temp\e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe
"C:\Users\Admin\AppData\Local\Temp\e45e8089d322ae91662bfa63940e82db2c5eb542ffc6862333d712309305a843.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:1108

C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
52KB

MD5
1c354c65dcb6eb765ee0490f36ce5dac

SHA1
a2b752e60bff9cd1848585eb8e4b031a6bcceca1

SHA256
244e659dc565dcfebad18448a9044568432b6962b4f38f343f3cbbb92ee04ead

SHA512
37ce3fa155b0d7226cb10defefb4b5753cbe6e2d99cab82521cff9f87aad030e782e18c6209dacef559b0b5950f4b0f129a0a82cb9a9c885f55313ec436e56f0

Download Submit
memory/1108-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4456-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4456-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4456-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download