7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674

Analysis

max time kernel
63s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
Size

4.7MB
MD5

e6bab40afa17ee4ca68100bf093b77d7
SHA1

c2399d6d9bb661f470500c7bc1c922f270a1744d
SHA256

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674
SHA512

4b6750b499f63fcb0cb40d97710dc9b0cf6861ad1ffc1750d7c815513d116dd1486a38e595af7cccb88d47f342ba099c7aa30b28582b2a947a1c9b64419d1a74
SSDEEP

98304:Z2ZeGl6O8wzfF7Nr9Qs2yx+nSOQtFrPGLec+3iS28nJcmmH5pL2NdaQv:Yf6sBB3UQDGLH+SP8nlCj2j7

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2148-135-0x0000000002D90000-0x0000000002E02000-memory.dmp	upx
behavioral2/memory/2148-136-0x0000000002D90000-0x0000000002E02000-memory.dmp	upx
behavioral2/memory/2148-137-0x0000000002E20000-0x0000000002E92000-memory.dmp	upx
behavioral2/memory/2148-143-0x0000000002D90000-0x0000000002E02000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/2148-132-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect
behavioral2/memory/2148-142-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect

Loads dropped DLL 1 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid process

2148 7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid	process
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

3780 cmd.exe

pid	process
3780	cmd.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid	process
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

description	pid	process	target process
PID 2148 wrote to memory of 3780	2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe
PID 2148 wrote to memory of 3780	2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe
PID 2148 wrote to memory of 3780	2148	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
"C:\Users\Admin\AppData\Local\Temp\7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\e5702ee.tmp.bat
2⤵
- Suspicious behavior: RenamesItself
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
Filesize
98KB

MD5
1dd2a4a0f4d21eb65db5895fca2ca489

SHA1
b0c0617f6f66b35e255ec9824cde41f382a60e80

SHA256
7a7f037bab8024a9d17fb225cc4aa04133081135ecc4be5bbb889c0fbebd7e0c

SHA512
214e7aa56e820ebec87a778293871672f7c4e92d06bdf5ba18a2fc536003b2e15ebdce65c1ae3c927a16fcfe865c1720a7262e7a700459c66b4ae563374518ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5702ee.tmp.bat
Filesize
181B

MD5
0c9cc5bf7a517362e8467a9e97f9f6cc

SHA1
a99546093e7afab0643535923b540e5535806552

SHA256
34780403109df9c32295f3eec321c8ba4617c17e6038086d2e76c1728d4142b3

SHA512
beb02ed14cbcd60c33825e961cf3bb583f1871575dd7ccdcc3666eb1af382d3f1db8d8adcdd13e66d4abccbb230967a4d4473840970d93f42119d2844e84aa1d

Download Submit
memory/2148-132-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/2148-135-0x0000000002D90000-0x0000000002E02000-memory.dmp

Filesize
456KB

Download
memory/2148-136-0x0000000002D90000-0x0000000002E02000-memory.dmp

Filesize
456KB

Download
memory/2148-137-0x0000000002E20000-0x0000000002E92000-memory.dmp

Filesize
456KB

Download
memory/2148-138-0x0000000002E20000-0x0000000002E92000-memory.dmp

Filesize
456KB

Download
memory/2148-140-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/2148-142-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/2148-143-0x0000000002D90000-0x0000000002E02000-memory.dmp

Filesize
456KB

Download
memory/3780-141-0x0000000000000000-mapping.dmp

Download