9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96

General

Target

9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe
Size

2.4MB
MD5

7e8b83017a23b0689d96153cff3082be
SHA1

3447cb1807e91723e417cd329095153cb3f7c092
SHA256

9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96
SHA512

324df76b9c4756c05e449115f7c08953cb9d9448906288d8c3842097ab5df5bc812c0f189e77dbd94ad03f4941f05823718b017d13bd371fd6a05654621cdcb4

Score

8^/10

spyware vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Decoder.exe

pid process

1956 Decoder.exe

pid	process
1956	Decoder.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2044-3-0x0000000000A00000-0x0000000000A01000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
7 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1904 timeout.exe

flow	ioc
6	api.ipify.org
7	api.ipify.org

pid	process
1904	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe

pid	process
2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe
2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe

description pid process

Token: SeDebugPrivilege 2044 9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe

description	pid	process
Token: SeDebugPrivilege	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.execmd.exe

description	pid	process	target process
PID 2044 wrote to memory of 1956	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	Decoder.exe
PID 2044 wrote to memory of 1956	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	Decoder.exe
PID 2044 wrote to memory of 1956	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	Decoder.exe
PID 2044 wrote to memory of 1956	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	Decoder.exe
PID 2044 wrote to memory of 1120	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	cmd.exe
PID 2044 wrote to memory of 1120	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	cmd.exe
PID 2044 wrote to memory of 1120	2044	9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe	cmd.exe
PID 1120 wrote to memory of 1904	1120	cmd.exe	timeout.exe
PID 1120 wrote to memory of 1904	1120	cmd.exe	timeout.exe
PID 1120 wrote to memory of 1904	1120	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe
"C:\Users\Admin\AppData\Local\Temp\9e2dee304f08830bfa6613f4e2f3ed9747f0891e5edea6fdd24b621fab850a96.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\ProgramData\Decoder.exe
"C:\ProgramData\Decoder.exe"
2⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\system32\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decoder.exe
MD5
6bd60496fa24ada50ca869be53467c7c

SHA1
5afdeb2dade4a35e6d8feef1ef24e30075302d6c

SHA256
25dfe0485d9e8fc9380bd7fc63cfca88c3b9b8fc23c75349a68ecfea056ba04b

SHA512
bacd106d5f211a1c24ead24ef32266a68550c3be8dde75e7ef509e165590c058b590edb20c060f5a8ecaa3b785b0e9e2edd3e458146f042c1f12821f66735806

Download Submit
C:\ProgramData\Decoder.exe
MD5
6bd60496fa24ada50ca869be53467c7c

SHA1
5afdeb2dade4a35e6d8feef1ef24e30075302d6c

SHA256
25dfe0485d9e8fc9380bd7fc63cfca88c3b9b8fc23c75349a68ecfea056ba04b

SHA512
bacd106d5f211a1c24ead24ef32266a68550c3be8dde75e7ef509e165590c058b590edb20c060f5a8ecaa3b785b0e9e2edd3e458146f042c1f12821f66735806

Download Submit
C:\Users\Admin\AppData\Local\Temp\.cmd
MD5
73712247036b6a24d16502c57a3e5679

SHA1
65ca9edadb0773fc34db7dfefe9e6416f1ac17fa

SHA256
8bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0

SHA512
548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de

Download Submit
memory/1120-12-0x0000000000000000-mapping.dmp

Download
memory/1904-15-0x0000000000000000-mapping.dmp

Download
memory/1956-10-0x0000000000000000-mapping.dmp

Download
memory/1956-16-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-17-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1956-19-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download
memory/2044-9-0x000000001AC50000-0x000000001ACC1000-memory.dmp

Filesize
452KB

Download
memory/2044-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2044-2-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2044-5-0x000000001B880000-0x000000001B882000-memory.dmp

Filesize
8KB

Download
memory/2044-3-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads