c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
Size

2.7MB
MD5

08380f41a474b4827ba6293b0c618b48
SHA1

cb6468f7ac112afe3f6e4be4d2ba29ea8ca3d34b
SHA256

c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a
SHA512

4f91437da97b01e249221b5935cff16e19dec47494b8745a5c1810f639adc53848793826f17f87986e4e8be702e0606c96547e3cdba865a6a8b788635bebe821
SSDEEP

49152:jVvKYKnMuK0CcQh4Mgb1Iz4Mzd/J2ivWfHSHV8n3jTv4w2waARa1fWd:YauNc4bK4u/J2pHwV83jTww8AJd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/948-54-0x0000000000400000-0x0000000000834000-memory.dmp	vmprotect
behavioral1/memory/948-62-0x0000000000400000-0x0000000000834000-memory.dmp	vmprotect

Loads dropped DLL 3 IoCs

pid	Process
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
948	c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe

C:\Users\Admin\AppData\Local\Temp\c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe
"C:\Users\Admin\AppData\Local\Temp\c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E_N60005\EThread.fne

Filesize
60KB

MD5
206396257b97bd275a90ce6c2c0c37fd

SHA1
3cae4506a033cf7e97156d5261f2a247c6270f42

SHA256
64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c

SHA512
4c23e52b5b23b305c3172e01dd205e15fda8f20f8b60776ba59d080bf05bbbca456a0ed232f2e2a2bf01d32efb913063f89fb4928bc4d5d1c1eb4c4979803455

Download Submit
\Users\Admin\AppData\Local\Temp\E_N60005\iext.fnr

Filesize
204KB

MD5
856495a1605bfc7f62086d482b502c6f

SHA1
86ecc67a784bc69157d664850d489aab64f5f912

SHA256
8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf

SHA512
35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9

Download Submit
\Users\Admin\AppData\Local\Temp\E_N60005\krnln.fnr

Filesize
1.2MB

MD5
1eece63319e7c5f6718562129b1572f1

SHA1
089ea3a605639eb1292f6a2a9720f0b2801b0b6e

SHA256
4bed8a6e4e1548fddee40927b438132b47ef2aca6e9beb06b89fcf7714726310

SHA512
13537d1dd80fa87b6b908361957e8c434ca547a575c8c8aab43423063e60cb5523fb1843a467ae73db4a64d278c06b831551e78ae6d895201f7ef0c5b162c1ab

Download Submit
memory/948-54-0x0000000000400000-0x0000000000834000-memory.dmp

Filesize
4.2MB

Download
memory/948-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/948-58-0x0000000000250000-0x000000000026C000-memory.dmp

Filesize
112KB

Download
memory/948-60-0x0000000000840000-0x0000000000881000-memory.dmp

Filesize
260KB

Download
memory/948-62-0x0000000000400000-0x0000000000834000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads