Overview

overview

8

Static

static

8

852120f27f...93.exe

windows7_x64

8

852120f27f...93.exe

windows10_x64

8

Analysis

  • max time kernel
    105s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-03-2021 05:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593.exe

  • Size

    2.4MB

  • MD5

    a5e59a6ecd6a238985670d0c161e4754

  • SHA1

    3e9cb91346365ad2bcb3c6bfbdf6cb1975dc1fdd

  • SHA256

    852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593

  • SHA512

    afab9408422f748514bdaa2a0aa3ae8a74946e405080eb10b499c02f27d4664c47e5d8cae1615d9e586fb188f0a6115acbc3c31990a64ce8f672b2eace3ba7a5

Score
8/10
spywarevmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593.exe
    "C:\Users\Admin\AppData\Local\Temp\852120f27fea5d550352e2545cd748cdd01495ef3bb909012891255ae07ff593.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1640-2-0x000007FEF5C10000-0x000007FEF65FC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1640-3-0x0000000000080000-0x0000000000081000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1640-6-0x0000000000540000-0x0000000000541000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1640-5-0x000000001B910000-0x000000001B912000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1640-9-0x0000000002250000-0x00000000022C1000-memory.dmp
    Filesize

    452KB

    Download