6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76

General

Target

6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
Size

2.1MB
MD5

682558c06c1f58e2fed3c4454c860567
SHA1

043845b9894849f5e22e0d2793347fee34b3c4e3
SHA256

6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76
SHA512

5a6a7fc001d96ae201c778c12a107b24164c0f91db7d7f110fd27d666ebc3b6037bcc77d6880b5d79090afb41ea2f7d3fc5adfd8b1920cb9a00b31b3f0195dde
SSDEEP

49152:a++1fkqbtkftPcnUfQ2AyoIw/QmyPvY/rHVt0:BE8qbct0nC9oIwYmyPark

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4916-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-135-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-178-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-176-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4916-179-0x00000000026A0000-0x0000000002712000-memory.dmp	upx
behavioral2/memory/4916-180-0x00000000026A0000-0x0000000002712000-memory.dmp	upx
behavioral2/memory/4916-182-0x00000000026A0000-0x0000000002712000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4916-132-0x0000000000400000-0x0000000000657000-memory.dmp	vmprotect
behavioral2/memory/4916-148-0x0000000000400000-0x0000000000657000-memory.dmp	vmprotect
behavioral2/memory/4916-181-0x0000000000400000-0x0000000000657000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe

pid process

4916 6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe

pid	process
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe

pid	process
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
4916	6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe

C:\Users\Admin\AppData\Local\Temp\6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe
"C:\Users\Admin\AppData\Local\Temp\6588bf866e215aa89aff5f90200c2a636328ff5fdbede279145a53d2e651dc76.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4916-132-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4916-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-135-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-148-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4916-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-178-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-176-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4916-179-0x00000000026A0000-0x0000000002712000-memory.dmp

Filesize
456KB

Download
memory/4916-180-0x00000000026A0000-0x0000000002712000-memory.dmp

Filesize
456KB

Download
memory/4916-181-0x0000000000400000-0x0000000000657000-memory.dmp

Filesize
2.3MB

Download
memory/4916-182-0x00000000026A0000-0x0000000002712000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads