Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 04:04
Behavioral task
behavioral1
Sample
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe
Resource
win10v2004-20240508-en
General
-
Target
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe
-
Size
4.2MB
-
MD5
ba611d08458c35c06eb92877ed0c63cd
-
SHA1
c06431628be2091c24e7a6dc08952fec66e6e204
-
SHA256
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3
-
SHA512
028a94429d791cec47c9c31d381d4d88326045d0a3bb93fc17225b749ed9e0f8dd7b0efae8d847ca51c0dfc5e24a0c5518d97e8e124ad8555a34a1232dbb77a8
-
SSDEEP
98304:qJQAn5XadZI+4OkOZc59YSSv2ksctxT5RcL9P8e4jtigwvfvSt:+QAcW+BAuSdksWxTLcVeiJHQ
Malware Config
Signatures
-
Detects executables packed with VMProtect. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2300-35-0x0000000000400000-0x0000000000AE3000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/2300-39-0x0000000000400000-0x0000000000AE3000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
Processes:
resource yara_rule behavioral1/memory/2300-35-0x0000000000400000-0x0000000000AE3000-memory.dmp vmprotect behavioral1/memory/2300-39-0x0000000000400000-0x0000000000AE3000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exepid process 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exepid process 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exedescription pid process Token: SeDebugPrivilege 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exedescription pid process target process PID 2300 wrote to memory of 2732 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe cmd.exe PID 2300 wrote to memory of 2732 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe cmd.exe PID 2300 wrote to memory of 2732 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe cmd.exe PID 2300 wrote to memory of 2732 2300 dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"C:\Users\Admin\AppData\Local\Temp\dfa0b62eafecc8e21670c6f4a56439a900a6dc89fe81fbfeac3193489a92bdf3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /K prompt $g2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\adb.exeFilesize
5.6MB
MD51eb885c863d208e330e3a961849322eb
SHA1cf909df4d928aa9053e2817fa10232880b56ca55
SHA256e1657ca239bcf53f60dd622a8476d51b8df3c2a3169f7b6082142942560627ed
SHA512d5a72e2aa0170d3fa41dd968a5f5e70a568c53d5449fbd0788ad016da0b6e1f1caa2c45cfdd7fdcf0a23205150e6578d25ed215b313de8dcbdae1b3a2e67bce4
-
memory/2300-22-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2300-35-0x0000000000400000-0x0000000000AE3000-memory.dmpFilesize
6.9MB
-
memory/2300-17-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2300-34-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2300-32-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2300-30-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2300-29-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2300-27-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2300-14-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2300-2-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2300-0-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2300-36-0x0000000000426000-0x00000000006AE000-memory.dmpFilesize
2.5MB
-
memory/2300-24-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2300-12-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2300-9-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2300-7-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2300-5-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2300-4-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2300-39-0x0000000000400000-0x0000000000AE3000-memory.dmpFilesize
6.9MB
-
memory/2300-40-0x0000000005040000-0x00000000050F4000-memory.dmpFilesize
720KB
-
memory/2300-41-0x0000000004F90000-0x0000000005042000-memory.dmpFilesize
712KB
-
memory/2300-19-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB