Analysis
-
max time kernel
157s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 04:20
Static task
static1
Behavioral task
behavioral1
Sample
0e420883d2be62142236382baa02afdd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e420883d2be62142236382baa02afdd.exe
Resource
win10v2004-20231215-en
General
-
Target
0e420883d2be62142236382baa02afdd.exe
-
Size
2.1MB
-
MD5
0e420883d2be62142236382baa02afdd
-
SHA1
a290b646554445bb7a03f1354d6689aff7322c42
-
SHA256
ec9adbc911233ae9e6b8503adfea7504a204f92ce520f6023f2967554434801e
-
SHA512
32bbb8d82f86a77ced61912708c0c3d6d0aa2669306f2d078883fcb43123177c584758a6e5efe34a00b9c2b8e2c38047070201990d25c8d3c0c881f5dfa31bcf
-
SSDEEP
49152:l75IAQokcJtjvEFRP0jPedDSB37l0LKlsd4Vq66KGPpt5h:95IiNtLOP0Se3pmdHKo5
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4976 0e420883d2be62142236382baa02afdd.tmp -
Loads dropped DLL 2 IoCs
pid Process 4976 0e420883d2be62142236382baa02afdd.tmp 4976 0e420883d2be62142236382baa02afdd.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1076 wrote to memory of 4976 1076 0e420883d2be62142236382baa02afdd.exe 93 PID 1076 wrote to memory of 4976 1076 0e420883d2be62142236382baa02afdd.exe 93 PID 1076 wrote to memory of 4976 1076 0e420883d2be62142236382baa02afdd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e420883d2be62142236382baa02afdd.exe"C:\Users\Admin\AppData\Local\Temp\0e420883d2be62142236382baa02afdd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\is-OK4MC.tmp\0e420883d2be62142236382baa02afdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-OK4MC.tmp\0e420883d2be62142236382baa02afdd.tmp" /SL5="$B0174,1914955,57856,C:\Users\Admin\AppData\Local\Temp\0e420883d2be62142236382baa02afdd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4976
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49