Overview

overview

7

Static

static

7

0e024796dc...ed.exe

windows7-x64

7

0e024796dc...ed.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 04:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0e024796dc5a4ae55ff539b480718bed.exe

  • Size

    5.3MB

  • MD5

    0e024796dc5a4ae55ff539b480718bed

  • SHA1

    16dd79f5a578dc9fb90406d7481c9a4cfc2bd458

  • SHA256

    0caa6bf8c2091e6ec444366d13f7bb4b2fe7ef8ead418752951235c567f52cfe

  • SHA512

    0338d2b901bd2786f562c7ca85b18751f0ddc212aff757d45547cad35481fd6cd7324f1aefaade2dd749ba5fda99cc3f99686e1aa8d04e29c05f6bb792969962

  • SSDEEP

    98304:HlHkEHaUXH9mELsXZE0H54CTRKLHrEyH9mELsXZE0Hj:HqEHzXY64VbeLEyY64VD

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e024796dc5a4ae55ff539b480718bed.exe
    "C:\Users\Admin\AppData\Local\Temp\0e024796dc5a4ae55ff539b480718bed.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Users\Admin\AppData\Local\Temp\0e024796dc5a4ae55ff539b480718bed.exe
      C:\Users\Admin\AppData\Local\Temp\0e024796dc5a4ae55ff539b480718bed.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1048

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\0e024796dc5a4ae55ff539b480718bed.exe
          Filesize

          2.6MB

          MD5

          b4358829dd4c5a0bbf384c2e3f0298ba

          SHA1

          0e437d64870dbf0bbbe0086bd27651bc5c53ab3a

          SHA256

          3d134e95671fe94ee12a8ca56e423a6bfbf6546e4795eb68ea0cc88ac65fd73d

          SHA512

          7512c857461c2887dc6fe65783a107686f428626762f1edd83cb27839893e00fce479e5d977096043f75ced97794303d3bd3169c679303c2143491d2a3368ea7

          Download Submit

        • memory/1048-13-0x0000000000400000-0x00000000008E7000-memory.dmp

          Filesize

          4.9MB

          Download

        • memory/1048-15-0x0000000000400000-0x0000000000622000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/1048-14-0x00000000018F0000-0x0000000001A21000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1048-20-0x00000000055D0000-0x00000000057F2000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/1048-21-0x0000000000400000-0x0000000000616000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/1048-27-0x0000000000400000-0x00000000008E7000-memory.dmp

          Filesize

          4.9MB

          Download

        • memory/5116-0-0x0000000000400000-0x00000000008E7000-memory.dmp

          Filesize

          4.9MB

          Download

        • memory/5116-1-0x0000000001CF0000-0x0000000001E21000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/5116-2-0x0000000000400000-0x0000000000622000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/5116-12-0x0000000000400000-0x0000000000622000-memory.dmp

          Filesize

          2.1MB

          Download