a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb

General

Target

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
Size

10.9MB
MD5

b749f1570495cd9f7a365661322a7494
SHA1

f24135f45662bc0aaf41f12b5e2cbb85a8334ace
SHA256

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb
SHA512

fa04628d79dcfd0cd9e3ccf1ab1168b376edad84edd76b9c0e25a25ade66e6bc36052eb32d8c3ffa44e97dbc3576c9029354d4723f1d9057b658d0778585327b
SSDEEP

196608:V0aGZeNa3ZFlVQN8LaTmEdoXqFRpsUBSyZXMScelsWPJlBvUa3ywu+th:V00NaLvL3Edo6XUymOV3f

Score

8^/10

persistence vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/3492-132-0x0000000000550000-0x0000000001A71000-memory.dmp	vmprotect
behavioral2/memory/3492-133-0x0000000000550000-0x0000000001A71000-memory.dmp	vmprotect
behavioral2/memory/4420-140-0x0000000000550000-0x0000000001A71000-memory.dmp	vmprotect
behavioral2/memory/3492-141-0x0000000000550000-0x0000000001A71000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3492-133-0x0000000000550000-0x0000000001A71000-memory.dmp	autoit_exe
behavioral2/memory/3492-141-0x0000000000550000-0x0000000001A71000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	pid	process	target process
PID 3492 set thread context of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

pid	process
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

description	pid	process	target process
PID 3492 wrote to memory of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 3492 wrote to memory of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 3492 wrote to memory of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 3492 wrote to memory of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
PID 3492 wrote to memory of 4420	3492	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe	a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe

C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
"C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe
"C:\Users\Admin\AppData\Local\Temp\a5cf22e227cf258d7f6ffa1ac2e6354e96655056e38045c5e8da4f3d17d767cb.exe"
2⤵
PID:4420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-132-0x0000000000550000-0x0000000001A71000-memory.dmp

Filesize
21.1MB

Download
memory/3492-133-0x0000000000550000-0x0000000001A71000-memory.dmp

Filesize
21.1MB

Download
memory/3492-141-0x0000000000550000-0x0000000001A71000-memory.dmp

Filesize
21.1MB

Download
memory/4420-136-0x0000000000000000-mapping.dmp

Download
memory/4420-137-0x0000000002200000-0x0000000002A68000-memory.dmp

Filesize
8.4MB

Download
memory/4420-138-0x0000000002200000-0x0000000002A68000-memory.dmp

Filesize
8.4MB

Download
memory/4420-139-0x0000000002200000-0x0000000002A68000-memory.dmp

Filesize
8.4MB

Download
memory/4420-140-0x0000000000550000-0x0000000001A71000-memory.dmp

Filesize
21.1MB

Download
memory/4420-142-0x0000000002200000-0x0000000002A68000-memory.dmp

Filesize
8.4MB

Download
memory/4420-143-0x0000000002200000-0x0000000002A68000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads