Analysis
-
max time kernel
4294211s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
21-03-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
c40967960f1817c1458a587cdab9e3a2.exe
Resource
win7-20220311-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c40967960f1817c1458a587cdab9e3a2.exe
Resource
win10v2004-20220310-en
0 signatures
0 seconds
General
-
Target
c40967960f1817c1458a587cdab9e3a2.exe
-
Size
189KB
-
MD5
c40967960f1817c1458a587cdab9e3a2
-
SHA1
0f7fd80ae64aa53afae14571c7ee47a159a33bbc
-
SHA256
1d4bf0958c9382e0ab0ee9dc4240fd01aa6c17b045f60a5fbe0a92663ccb875c
-
SHA512
8ec11c41deccaa9ba05eee5ed3b3fc017035310347b47fae9ec44534ce83cca5df74d00c520d30b4357066284982753b11ecb527a5ce163896e4c78b6d706562
Score
10/10
Malware Config
Signatures
-
VKeylogger
A keylogger first seen in Nov 2020.
-
VKeylogger Payload 16 IoCs
resource yara_rule behavioral1/memory/1616-61-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1616-63-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1616-65-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1616-67-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1548-68-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1012-84-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/360-100-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1000-115-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1664-130-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1684-145-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1476-161-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/2028-177-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/632-192-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1844-195-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/556-211-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger behavioral1/memory/1684-227-0x0000000000A20000-0x0000000000A4F000-memory.dmp family_vkeylogger -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 1548 set thread context of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1012 set thread context of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 360 set thread context of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 1000 set thread context of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1664 set thread context of 1256 1664 c40967960f1817c1458a587cdab9e3a2.exe 41 PID 1684 set thread context of 1072 1684 c40967960f1817c1458a587cdab9e3a2.exe 44 PID 1476 set thread context of 108 1476 c40967960f1817c1458a587cdab9e3a2.exe 47 PID 2028 set thread context of 968 2028 c40967960f1817c1458a587cdab9e3a2.exe 50 PID 632 set thread context of 1260 632 c40967960f1817c1458a587cdab9e3a2.exe 53 PID 556 set thread context of 1628 556 c40967960f1817c1458a587cdab9e3a2.exe 57 PID 1684 set thread context of 1168 1684 c40967960f1817c1458a587cdab9e3a2.exe 60 -
Program crash 11 IoCs
pid pid_target Process procid_target 1572 1616 WerFault.exe 27 1988 1740 WerFault.exe 30 1228 540 WerFault.exe 33 868 1600 WerFault.exe 36 1512 1256 WerFault.exe 41 576 1072 WerFault.exe 44 848 108 WerFault.exe 47 1736 968 WerFault.exe 50 328 1260 WerFault.exe 53 1456 1628 WerFault.exe 57 2044 1168 WerFault.exe 60 -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1548 c40967960f1817c1458a587cdab9e3a2.exe 1012 c40967960f1817c1458a587cdab9e3a2.exe 1012 c40967960f1817c1458a587cdab9e3a2.exe 360 c40967960f1817c1458a587cdab9e3a2.exe 360 c40967960f1817c1458a587cdab9e3a2.exe 1000 c40967960f1817c1458a587cdab9e3a2.exe 1000 c40967960f1817c1458a587cdab9e3a2.exe 1664 c40967960f1817c1458a587cdab9e3a2.exe 1664 c40967960f1817c1458a587cdab9e3a2.exe 1684 c40967960f1817c1458a587cdab9e3a2.exe 1684 c40967960f1817c1458a587cdab9e3a2.exe 1476 c40967960f1817c1458a587cdab9e3a2.exe 1476 c40967960f1817c1458a587cdab9e3a2.exe 2028 c40967960f1817c1458a587cdab9e3a2.exe 2028 c40967960f1817c1458a587cdab9e3a2.exe 632 c40967960f1817c1458a587cdab9e3a2.exe 632 c40967960f1817c1458a587cdab9e3a2.exe 556 c40967960f1817c1458a587cdab9e3a2.exe 556 c40967960f1817c1458a587cdab9e3a2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1548 wrote to memory of 1616 1548 c40967960f1817c1458a587cdab9e3a2.exe 27 PID 1616 wrote to memory of 1572 1616 c40967960f1817c1458a587cdab9e3a2.exe 28 PID 1616 wrote to memory of 1572 1616 c40967960f1817c1458a587cdab9e3a2.exe 28 PID 1616 wrote to memory of 1572 1616 c40967960f1817c1458a587cdab9e3a2.exe 28 PID 1616 wrote to memory of 1572 1616 c40967960f1817c1458a587cdab9e3a2.exe 28 PID 1548 wrote to memory of 1012 1548 c40967960f1817c1458a587cdab9e3a2.exe 29 PID 1548 wrote to memory of 1012 1548 c40967960f1817c1458a587cdab9e3a2.exe 29 PID 1548 wrote to memory of 1012 1548 c40967960f1817c1458a587cdab9e3a2.exe 29 PID 1548 wrote to memory of 1012 1548 c40967960f1817c1458a587cdab9e3a2.exe 29 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1012 wrote to memory of 1740 1012 c40967960f1817c1458a587cdab9e3a2.exe 30 PID 1740 wrote to memory of 1988 1740 c40967960f1817c1458a587cdab9e3a2.exe 31 PID 1740 wrote to memory of 1988 1740 c40967960f1817c1458a587cdab9e3a2.exe 31 PID 1740 wrote to memory of 1988 1740 c40967960f1817c1458a587cdab9e3a2.exe 31 PID 1740 wrote to memory of 1988 1740 c40967960f1817c1458a587cdab9e3a2.exe 31 PID 1012 wrote to memory of 360 1012 c40967960f1817c1458a587cdab9e3a2.exe 32 PID 1012 wrote to memory of 360 1012 c40967960f1817c1458a587cdab9e3a2.exe 32 PID 1012 wrote to memory of 360 1012 c40967960f1817c1458a587cdab9e3a2.exe 32 PID 1012 wrote to memory of 360 1012 c40967960f1817c1458a587cdab9e3a2.exe 32 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 360 wrote to memory of 540 360 c40967960f1817c1458a587cdab9e3a2.exe 33 PID 540 wrote to memory of 1228 540 c40967960f1817c1458a587cdab9e3a2.exe 34 PID 540 wrote to memory of 1228 540 c40967960f1817c1458a587cdab9e3a2.exe 34 PID 540 wrote to memory of 1228 540 c40967960f1817c1458a587cdab9e3a2.exe 34 PID 540 wrote to memory of 1228 540 c40967960f1817c1458a587cdab9e3a2.exe 34 PID 360 wrote to memory of 1000 360 c40967960f1817c1458a587cdab9e3a2.exe 35 PID 360 wrote to memory of 1000 360 c40967960f1817c1458a587cdab9e3a2.exe 35 PID 360 wrote to memory of 1000 360 c40967960f1817c1458a587cdab9e3a2.exe 35 PID 360 wrote to memory of 1000 360 c40967960f1817c1458a587cdab9e3a2.exe 35 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36 PID 1000 wrote to memory of 1600 1000 c40967960f1817c1458a587cdab9e3a2.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 363⤵
- Program crash
PID:1572
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 364⤵
- Program crash
PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 365⤵
- Program crash
PID:1228
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"5⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 366⤵
- Program crash
PID:868
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"6⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 367⤵
- Program crash
PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"7⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 368⤵
- Program crash
PID:576
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"8⤵PID:108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 369⤵
- Program crash
PID:848
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"9⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 3610⤵
- Program crash
PID:1736
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:632 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"10⤵PID:1260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 3611⤵
- Program crash
PID:328
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"10⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:556 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"12⤵PID:1628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 3613⤵
- Program crash
PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"12⤵
- Suspicious use of SetThreadContext
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"C:\Users\Admin\AppData\Local\Temp\c40967960f1817c1458a587cdab9e3a2.exe"13⤵PID:1168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 3614⤵
- Program crash
PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-