dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 03:36

Target

dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe
Size

92KB
MD5

b4f26096a6559a46126bf82bd1ebfe9d
SHA1

9548f75064edf0e321c574b624b3d1cd330aa431
SHA256

dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8
SHA512

8ab2920769dca25b73e72a925a8476e6044cde5b14092d3874fb45ecf4815faf2af6758d6c4b6ea0e2f921f1c8482e01d058df6f7d616f0daead0bfe7898c950
SSDEEP

1536:0MybiksPWaKVqY3k8qD3uFbzzO8C4Y9c+sJUZy/K/j/DHKs6d:ty+3WaKVGD3uFHC8C4jWo

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3112	olacweegim.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3112	1600	dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe	86
PID 1600 wrote to memory of 3112	1600	dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe	86
PID 1600 wrote to memory of 3112	1600	dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe	86

C:\Users\Admin\AppData\Local\Temp\dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe
"C:\Users\Admin\AppData\Local\Temp\dc425423187c224769694ed90cc5d349450e491827e9e834e196d6eb60e832f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:3112

C:\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
92KB

MD5
439eacbe83f29248c5b60fb31cdd9ff2

SHA1
29da829bfa6723821914b61813c81ea44a53c806

SHA256
fd62734b596e32e1a82231f3d0f79b007400f2ad366ba56c61243117d270511d

SHA512
510ffe4a6431390eff3d9cd1ea8dcdd7bfc95d1f237238a1ab6a4365df6881dbd1575b411d8390e212e45281ade3926f5a6e7b872dbf5cba2b205064d5d35f71

Download Submit
memory/1600-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1600-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3112-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download