Overview

overview

7

Static

static

7

24e4cef83f...a6.exe

windows7-x64

7

24e4cef83f...a6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    24e4cef83f5f63ee86a31b8de47186a6.exe

  • Size

    2.7MB

  • MD5

    24e4cef83f5f63ee86a31b8de47186a6

  • SHA1

    6d14abeb00e7f52b9938a0b9e2ff2aa262505a5c

  • SHA256

    8edf010cece0569f9dcc24c6f931b4f076894cfe77e6c1ac1f3a9f9ee1f81717

  • SHA512

    31164169d3fba91bd5578ef6bf2875b38a217c5ba37ef45f0730d54d1624211c6aa2d8d7d699fa0e1e78695a73e78255160e89484130658b44bce0f46418e559

  • SSDEEP

    24576:ui7Nwhl8RVDVCqrnqON7nth9gwcOdlHDUP/McvGG4bczE7h6XGA3KLqwP+WCF8R8:V7kaBCqrnqOtnFswUGcolK3Ng9kgZEO

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24e4cef83f5f63ee86a31b8de47186a6.exe
    "C:\Users\Admin\AppData\Local\Temp\24e4cef83f5f63ee86a31b8de47186a6.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Users\Admin\AppData\Local\Temp\24e4cef83f5f63ee86a31b8de47186a6.exe
      C:\Users\Admin\AppData\Local\Temp\24e4cef83f5f63ee86a31b8de47186a6.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:396

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\24e4cef83f5f63ee86a31b8de47186a6.exe
          Filesize

          375KB

          MD5

          3a96bb09ca39e6153fae21e994ceed70

          SHA1

          5f4216b1b1d87db92ba0ed0937fd1b5f9e0cf55d

          SHA256

          c6a02f63a40f45c7b973badf85a9da760a422f3adbc414c5778a1a00b5f311de

          SHA512

          1a8f195e992bea798c4d0a2d6adecc77ce8c3a75ed60df5f980c9cc2d8aee5166513cc90dfea59a911902f911636c4c02bd6ed28cb3e79e82c46324dc44e7298

          Download Submit

        • memory/208-0-0x0000000000400000-0x000000000086A000-memory.dmp

          Filesize

          4.4MB

          Download

        • memory/208-1-0x0000000001870000-0x0000000001982000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/208-2-0x0000000000400000-0x00000000005F2000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/208-14-0x0000000000400000-0x00000000005F2000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/396-15-0x0000000000400000-0x000000000086A000-memory.dmp

          Filesize

          4.4MB

          Download

        • memory/396-17-0x0000000000400000-0x00000000005F2000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/396-16-0x0000000001870000-0x0000000001982000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/396-24-0x0000000000400000-0x000000000086A000-memory.dmp

          Filesize

          4.4MB

          Download