Resubmissions
25-11-2022 11:39
221125-nslmxseb32 8Analysis
-
max time kernel
102s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 11:39
General
-
Target
eOWDJmB3Qt.exe
-
Size
3.4MB
-
MD5
a198d2e7ddac7c3d381da9b2e5446142
-
SHA1
61aff012de5ac9eb5247f182320b1df434a22c93
-
SHA256
f432910b309b296e4cf2e662092657060f0e24222ccf1239a67c69b9db8daf68
-
SHA512
6e661c2c46ea0f57dc0dafe0e01bc32258d740d9938bec27b7558ae020ff51cdfd41351df52b06da86f25dc59c318fa37660b7da51ad34dd69b0f8bcbcb6b44a
-
SSDEEP
98304:ZBvIB2CVEqzsJGwUv6Fvx6KW2wBBJIdnjjgI8D:ZekJGwUi1WMjjW
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eOWDJmB3Qt.exe"C:\Users\Admin\AppData\Local\Temp\eOWDJmB3Qt.exe"1⤵
- Sets service image path in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1784-54-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB
-
memory/1784-55-0x0000000000400000-0x0000000000B45000-memory.dmpFilesize
7.3MB
-
memory/1784-58-0x0000000000400000-0x0000000000B45000-memory.dmpFilesize
7.3MB