b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b

Analysis

max time kernel
153s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 01:25

Target

b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe
Size

81KB
MD5

c6e5a834101d924e9f08f474cad5df06
SHA1

4f64048e91b13ea2f31ae7b5f0b558f81257020d
SHA256

b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b
SHA512

e2dc6efa3e91d5c304c2999a695ffea0e8ae384889c75e6351788f934c83f87bcd887680623fbe5f5b259d8deedda4643debc5896bab8758a18189e4711ad661
SSDEEP

1536:0M0yNStPY+z0mHkGDcfcQfNWbh8UH9SZ47Qn/aKPg3y:tylY+zlDcfceeH9SZ4uau

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2416	olacweegim.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2416	1600	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	98
PID 1600 wrote to memory of 2416	1600	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	98
PID 1600 wrote to memory of 2416	1600	b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe	98

C:\Users\Admin\AppData\Local\Temp\b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe
"C:\Users\Admin\AppData\Local\Temp\b7d42b692e80bd7d905e8cd02049cac89c4424d09d2d606c542b63649f870f8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1268 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
81KB

MD5
d4ce4049d032da7049521c66b4f9fb37

SHA1
248285cf5775fac638620f031cb80b1aad811559

SHA256
268a2a6d280a160f58d635f7517c6ab514c55d5498bd39bb0341c9e307e1acc1

SHA512
87afdf8f5b80ced1cc535a9aede2e12870fb9592e604652e21b5a1bb5f85f4237deef15209734193a48cd4ca9ed9fbd6098daa79fc777e757edd0ff6c5b08d79

Download Submit
memory/1600-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1600-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2416-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download