Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
26-11-2022 05:23
General
-
Target
SkinLienMinh.exe
-
Size
988KB
-
MD5
2eed3a0e4c9c11c708cee31112d047aa
-
SHA1
4b809cfc6eacfb52931494c0ef5e94e4f86cb395
-
SHA256
acf14395284eec73fb37ede06b640b2e464c14e99992fcceb726778ddfc38a72
-
SHA512
05fcf13db0c9dddc611104f6eb9a84601ffdeaf94d12c6576427ae16c5727816dc6eada2eb20b7394bb55548b61f972c4e6f86e9b6e563efc9d6b9408bd504e2
-
SSDEEP
24576:GL7nPDCVHS5MGaKqjBskO8amG01Q0fFQidm:GLLuAFaK2y/aG01Q0mt
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SkinLienMinh.exe"C:\Users\Admin\AppData\Local\Temp\SkinLienMinh.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1492-54-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB
-
memory/1492-57-0x00000000031B0000-0x0000000003374000-memory.dmpFilesize
1.8MB
-
memory/1492-59-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1492-60-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB
-
memory/1492-64-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB