a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb

General

Target

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
Size

10.9MB
MD5

b749f1570495cd9f7a365661322a7494
SHA1

f24135f45662bc0aaf41f12b5e2cbb85a8334ace
SHA256

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb
SHA512

fa04628d79dcfd0cd9e3ccf1ab1168b376edad84edd76b9c0e25a25ade66e6bc36052eb32d8c3ffa44e97dbc3576c9029354d4723f1d9057b658d0778585327b
SSDEEP

196608:V0aGZeNa3ZFlVQN8LaTmEdoXqFRpsUBSyZXMScelsWPJlBvUa3ywu+th:V00NaLvL3Edo6XUymOV3f

Score

8^/10

persistence vmprotect

Malware Config

Signatures

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2028-55-0x00000000003D0000-0x00000000018F1000-memory.dmp	vmprotect
behavioral1/memory/2028-56-0x00000000003D0000-0x00000000018F1000-memory.dmp	vmprotect
behavioral1/memory/2028-58-0x00000000003D0000-0x00000000018F1000-memory.dmp	vmprotect
behavioral1/memory/2028-66-0x00000000003D0000-0x00000000018F1000-memory.dmp	vmprotect
behavioral1/memory/532-69-0x00000000003D0000-0x00000000018F1000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2028-56-0x00000000003D0000-0x00000000018F1000-memory.dmp	autoit_exe
behavioral1/memory/2028-58-0x00000000003D0000-0x00000000018F1000-memory.dmp	autoit_exe
behavioral1/memory/2028-66-0x00000000003D0000-0x00000000018F1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	pid	process	target process
PID 2028 set thread context of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

pid	process
2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	pid	process	target process
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 2028 wrote to memory of 532	2028	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
"C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
"C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"
2⤵
PID:532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-65-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-61-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-71-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-70-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-63-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-69-0x00000000003D0000-0x00000000018F1000-memory.dmp

Filesize
21.1MB

Download
memory/532-68-0x0000000001E90000-0x00000000026F8000-memory.dmp

Filesize
8.4MB

Download
memory/532-64-0x0000000002025A18-mapping.dmp

Download
memory/2028-59-0x0000000007990000-0x0000000008EB1000-memory.dmp

Filesize
21.1MB

Download
memory/2028-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2028-66-0x00000000003D0000-0x00000000018F1000-memory.dmp

Filesize
21.1MB

Download
memory/2028-55-0x00000000003D0000-0x00000000018F1000-memory.dmp

Filesize
21.1MB

Download
memory/2028-60-0x0000000007990000-0x0000000008EB1000-memory.dmp

Filesize
21.1MB

Download
memory/2028-58-0x00000000003D0000-0x00000000018F1000-memory.dmp

Filesize
21.1MB

Download
memory/2028-56-0x00000000003D0000-0x00000000018F1000-memory.dmp

Filesize
21.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads