4bb31847846180bf78033b5eb7761b874b114f6dd086862472915be761fc042a | Triage

Analysis

max time kernel
112s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-06-2022 14:12

Sharing

Report Analysis Logs

General

Target

7zS8A52FD1B/62a1ea2d09364_3056ccd.exe
Size

3.7MB
MD5

e77f09a338e643ee05ad09e367eedf73
SHA1

6777cd291ece93e16aa95c3e60b63d46b1b142bd
SHA256

f32c3414f14e0b4c08183af08702736a2ed18c99101d5ee1bc5bc5e8ee3c8982
SHA512

53f59267e4bfe862e51edb0fd7d356485a7349e7ccd6439c6c88bda921a67909a36efd1690d06fe3c30c8a4433d5c4c1a34c30b928cb29ec45b08045ef4f5747

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral16/memory/2664-130-0x0000000140000000-0x000000014067D000-memory.dmp	vmprotect

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 2664 WerFault.exe 62a1ea2d09364_3056ccd.exe

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2d09364_3056ccd.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2d09364_3056ccd.exe"
1⤵
PID:2664

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2664 -s 896
2⤵
- Program crash
PID:1292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 2664 -ip 2664
1⤵
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-130-0x0000000140000000-0x000000014067D000-memory.dmp

Filesize
6.5MB

Download