Overview

overview

10

Static

static

8

197f0e170f...2a.exe

windows7_x64

9

197f0e170f...2a.exe

windows10_x64

9

302d77c6ec...56.exe

windows7_x64

8

302d77c6ec...56.exe

windows10_x64

8

466d872ddb...0d.exe

windows7_x64

8

466d872ddb...0d.exe

windows10_x64

10

6d13a07022...f4.exe

windows7_x64

8

6d13a07022...f4.exe

windows10_x64

8

8c1d1de824...ef.exe

windows7_x64

1

8c1d1de824...ef.exe

windows10_x64

1

a31f1894f1...b8.exe

windows7_x64

8

a31f1894f1...b8.exe

windows10_x64

9

a3802c3a05...6d.exe

windows7_x64

10

a3802c3a05...6d.exe

windows10_x64

10

Android APK

android_x86_64

10

c6c0d4969a...36.exe

windows7_x64

1

c6c0d4969a...36.exe

windows10_x64

1

d92ef7281e...1a.exe

windows7_x64

1

d92ef7281e...1a.exe

windows10_x64

1

dffb2eaccb...3a.exe

windows7_x64

8

dffb2eaccb...3a.exe

windows10_x64

8

e247b061c8...b1.exe

windows7_x64

8

e247b061c8...b1.exe

windows10_x64

8

Analysis

  • max time kernel
    12s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    24-11-2020 02:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe

  • Size

    8.6MB

  • MD5

    3c4261d71d948d16d40c36805295a62b

  • SHA1

    0cf36394c41e79b2297c18ebc8fd0d0ee1ffdd9d

  • SHA256

    dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a

  • SHA512

    b7e6e153a68bb4ee5257e86a9ab7637db161ced3681f306217cb4d4fea2f63cd6eca54c662ca8a6509d94fc44cca0785a528371f95fe83f5442e9c213fe0febb

Score
8/10
vmprotect

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
    "C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
      "C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c pause
        3⤵
          PID:1260

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
      MD5

      96cbdad549f7dde80687cb495f123541

      SHA1

      e28f62e425399bb3fd2b1abfd0a9fee41e03d8ac

      SHA256

      56a530861b89add74b971415a321336a8c1c0df12ecc2d0f237248fea336c7e7

      SHA512

      4f50ed8ec94e247798a7d7ca2559e1cd2e35dbbb1714d7a29bf5cc2a6b81ea36a48ea27f34ec5a94492f9086a158a8758c94f4d4198bd6e4db1a700d706e4ab9

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
      MD5

      96cbdad549f7dde80687cb495f123541

      SHA1

      e28f62e425399bb3fd2b1abfd0a9fee41e03d8ac

      SHA256

      56a530861b89add74b971415a321336a8c1c0df12ecc2d0f237248fea336c7e7

      SHA512

      4f50ed8ec94e247798a7d7ca2559e1cd2e35dbbb1714d7a29bf5cc2a6b81ea36a48ea27f34ec5a94492f9086a158a8758c94f4d4198bd6e4db1a700d706e4ab9

      Download Submit
    • \Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
      MD5

      96cbdad549f7dde80687cb495f123541

      SHA1

      e28f62e425399bb3fd2b1abfd0a9fee41e03d8ac

      SHA256

      56a530861b89add74b971415a321336a8c1c0df12ecc2d0f237248fea336c7e7

      SHA512

      4f50ed8ec94e247798a7d7ca2559e1cd2e35dbbb1714d7a29bf5cc2a6b81ea36a48ea27f34ec5a94492f9086a158a8758c94f4d4198bd6e4db1a700d706e4ab9

      Download Submit
    • memory/1260-4-0x0000000000000000-mapping.dmp
      Download
    • memory/1776-1-0x0000000000000000-mapping.dmp
      Download