Analysis
- max time kernel
138s - max time network
63s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:05
General
- Target c69f89c00b8f77d605e233ed31485c744fc6bbe3860e447c7086cdf044bce888.exe
- Size 2.4MB
- Sample200624-bhlm2acxwe
- SHA256 c69f89c00b8f77d605e233ed31485c744fc6bbe3860e447c7086cdf044bce888
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Blacklisted process makes network request 1 IoCs
- Deletes itself 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of WriteProcessMemory 11 IoCs
- Suspicious use of SetThreadContext 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c69f89c00b8f77d605e233ed31485c744fc6bbe3860e447c7086cdf044bce888.exe"C:\Users\Admin\AppData\Local\Temp\c69f89c00b8f77d605e233ed31485c744fc6bbe3860e447c7086cdf044bce888.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Blacklisted process makes network request
- Deletes itself
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1000-1-0x00000000026F8000-0x0000000002A26000-memory.dmp
memory/1000-2-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1000-0-0x00000000026F0000-0x0000000002A2C000-memory.dmp
memory/1164-22-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-18-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-6-0x0000000004CF0000-0x000000000502C000-memory.dmp
memory/1164-7-0x0000000004CF3000-0x0000000005021000-memory.dmp
memory/1164-9-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-10-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-11-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-12-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-13-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-14-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-15-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-16-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-17-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-23-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-19-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-20-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-21-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-5-0x0000000000400000-0x00000000009AB000-memory.dmp
memory/1164-3-0x0000000000400000-0x00000000009AB000-memory.dmp
memory/1164-29-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-25-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-26-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-27-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-28-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-24-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-30-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-31-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-32-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-33-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-34-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-35-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-36-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-37-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-38-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-39-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-40-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-41-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-42-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/1164-43-0x0000000006C20000-0x0000000006C21000-memory.dmp