7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635

General

Target

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
Size

952KB
MD5

c8ccf573777e326b680e4f60614c5f64
SHA1

d956e1efc8adbda8cb98329f448962f7d5ae91e3
SHA256

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635
SHA512

b142a2e94381ce14a4cfd322eb8b5c51253a551e7392417f731eb018775754b2ed1f81f676634ced17d621a69e3b41c3a90efc97cd1d8dd3654e132d5e7605e4
SSDEEP

12288:lCsChjAZx3bfwVIEjVDwJubINFgqXkvljRnYkxQ/vtbmIbllCVyDDQAamhbW:lrXyjBwJubINFgq+Rnc1bTblMVs7hq

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 14 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2004-54-0x0000000000340000-0x0000000000716000-memory.dmp	vmprotect
behavioral1/memory/2004-55-0x0000000000340000-0x0000000000716000-memory.dmp	vmprotect
behavioral1/memory/2004-56-0x0000000000340000-0x0000000000716000-memory.dmp	vmprotect
behavioral1/memory/860-58-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-60-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-61-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-63-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-65-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-68-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/2004-67-0x0000000000340000-0x0000000000716000-memory.dmp	vmprotect
behavioral1/memory/860-71-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-72-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-74-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect
behavioral1/memory/860-77-0x0000000000240000-0x0000000000616000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.execttune.exe

pid	process
2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
860	cttune.exe
860	cttune.exe
860	cttune.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe

description	pid	process	target process
PID 2004 set thread context of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.execttune.exe

pid process

2004 7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
860 cttune.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe

description	pid	process	target process
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe
PID 2004 wrote to memory of 860	2004	7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe	cttune.exe

C:\Users\Admin\AppData\Local\Temp\7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
"C:\Users\Admin\AppData\Local\Temp\7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\cttune.exe
"C:\Windows\SysWOW64\cttune.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-64-0x00000000007B15E9-mapping.dmp

Download
memory/860-57-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-77-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-58-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-65-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-60-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-61-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-68-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-76-0x0000000000241000-0x000000000024C000-memory.dmp

Filesize
44KB

Download
memory/860-74-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-63-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-72-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/860-71-0x0000000000240000-0x0000000000616000-memory.dmp

Filesize
3.8MB

Download
memory/2004-67-0x0000000000340000-0x0000000000716000-memory.dmp

Filesize
3.8MB

Download
memory/2004-55-0x0000000000340000-0x0000000000716000-memory.dmp

Filesize
3.8MB

Download
memory/2004-56-0x0000000000340000-0x0000000000716000-memory.dmp

Filesize
3.8MB

Download
memory/2004-54-0x0000000000340000-0x0000000000716000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads