Analysis

  • max time kernel
    12s
  • max time network
    93s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    24-11-2020 02:32

General

  • Target

    dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe

  • Size

    8.6MB

  • MD5

    3c4261d71d948d16d40c36805295a62b

  • SHA1

    0cf36394c41e79b2297c18ebc8fd0d0ee1ffdd9d

  • SHA256

    dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a

  • SHA512

    b7e6e153a68bb4ee5257e86a9ab7637db161ced3681f306217cb4d4fea2f63cd6eca54c662ca8a6509d94fc44cca0785a528371f95fe83f5442e9c213fe0febb

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
    "C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
      "C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c pause
        3⤵
          PID:1376

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe

      MD5

      3088fde5b97f22859b11eab2a0c6854e

      SHA1

      0a66943916eb904cb8815d3d8e550db0fdf14b71

      SHA256

      7301584cf657694aecb7ec6aa55c8025d9d88e4ceadc8bd0513e4c37ec00462b

      SHA512

      f22849b3b299f6b51b75d7415f7374067e8d364451b64339c1666b8587583bb09a428f7524d008ab14cb9adb940d21937eb5f347a956ffee9cc85f09b10109ab

    • C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe

      MD5

      3088fde5b97f22859b11eab2a0c6854e

      SHA1

      0a66943916eb904cb8815d3d8e550db0fdf14b71

      SHA256

      7301584cf657694aecb7ec6aa55c8025d9d88e4ceadc8bd0513e4c37ec00462b

      SHA512

      f22849b3b299f6b51b75d7415f7374067e8d364451b64339c1666b8587583bb09a428f7524d008ab14cb9adb940d21937eb5f347a956ffee9cc85f09b10109ab

    • memory/508-0-0x0000000000000000-mapping.dmp

    • memory/1376-3-0x0000000000000000-mapping.dmp