vsingle | 3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:32

Target

3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe
Size

682KB
MD5

67f4dad1a94ed8a47283c2c0c05a7594
SHA1

3aa267fbb14f73c9db55d6556fa50373716c2f1b
SHA256

3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7
SHA512

29e7a6846f26fd58aeff9be712c22e526a5f18ad04c03a4b79586cb60f0f54961d4ee40415393ed89aebad2bddbaba67f00ef651c46632e77e8829fb9c4a20cf
SSDEEP

12288:3OQQtVcFaVUhHNsJbTjq8ERE//qQ6fvzWisJa6den5E/I4AANQePuqKG44O95Kqi:3OQQtVc4VUhHNsJ7q8T/b6fLcg6w5CXp

Score

10^/10

Detects VSingle payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4244-1-0x0000000000A20000-0x0000000000A8B000-memory.dmp	family_vsingle
behavioral2/memory/4244-2-0x0000000000E40000-0x0000000000EB1000-memory.dmp	family_vsingle
behavioral2/memory/4244-5-0x0000000000A20000-0x0000000000A8B000-memory.dmp	family_vsingle
behavioral2/memory/4244-6-0x0000000000E40000-0x0000000000EB1000-memory.dmp	family_vsingle

VSingle
VSingle is a loader written in C++ operated by the Lazarus APT group and discovered in 2022.
loader vsingle

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe

description	pid	process	target process
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	Explorer.exe
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	Explorer.exe
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	Explorer.exe
PID 2304 wrote to memory of 4244	2304	3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe	Explorer.exe

C:\Users\Admin\AppData\Local\Temp\3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe
"C:\Users\Admin\AppData\Local\Temp\3fe624c33790b409421f4fa2bb8abfd701df2231a959493c33187ed34bec0ae7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304

memory/2304-0-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/4244-1-0x0000000000A20000-0x0000000000A8B000-memory.dmp

Filesize
428KB

Download
memory/4244-2-0x0000000000E40000-0x0000000000EB1000-memory.dmp

Filesize
452KB

Download
memory/4244-5-0x0000000000A20000-0x0000000000A8B000-memory.dmp

Filesize
428KB

Download
memory/4244-6-0x0000000000E40000-0x0000000000EB1000-memory.dmp

Filesize
452KB

Download