b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 01:25

Target

b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe
Size

81KB
MD5

c6e5a834101d924e9f08f474cad5df06
SHA1

4f64048e91b13ea2f31ae7b5f0b558f81257020d
SHA256

b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b
SHA512

e2dc6efa3e91d5c304c2999a695ffea0e8ae384889c75e6351788f934c83f87bcd887680623fbe5f5b259d8deedda4643debc5896bab8758a18189e4711ad661
SSDEEP

1536:0M0yNStPY+z0mHkGDcfcQfNWbh8UH9SZ47Qn/aKPg3y:tylY+zlDcfceeH9SZ4uau

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1320	olacweegim.exe

Loads dropped DLL 1 IoCs

pid	Process
2792	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1320	2792	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	28
PID 2792 wrote to memory of 1320	2792	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	28
PID 2792 wrote to memory of 1320	2792	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	28
PID 2792 wrote to memory of 1320	2792	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	28

C:\Users\Admin\AppData\Local\Temp\b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe
"C:\Users\Admin\AppData\Local\Temp\b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:1320

\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
81KB

MD5
d4ce4049d032da7049521c66b4f9fb37

SHA1
248285cf5775fac638620f031cb80b1aad811559

SHA256
268a2a6d280a160f58d635f7517c6ab514c55d5498bd39bb0341c9e307e1acc1

SHA512
87afdf8f5b80ced1cc535a9aede2e12870fb9592e604652e21b5a1bb5f85f4237deef15209734193a48cd4ca9ed9fbd6098daa79fc777e757edd0ff6c5b08d79

Download Submit
memory/1320-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2792-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2792-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download