Analysis
-
max time kernel
156s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26-11-2022 20:45
General
-
Target
7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe
-
Size
952KB
-
MD5
c8ccf573777e326b680e4f60614c5f64
-
SHA1
d956e1efc8adbda8cb98329f448962f7d5ae91e3
-
SHA256
7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635
-
SHA512
b142a2e94381ce14a4cfd322eb8b5c51253a551e7392417f731eb018775754b2ed1f81f676634ced17d621a69e3b41c3a90efc97cd1d8dd3654e132d5e7605e4
-
SSDEEP
12288:lCsChjAZx3bfwVIEjVDwJubINFgqXkvljRnYkxQ/vtbmIbllCVyDDQAamhbW:lrXyjBwJubINFgq+Rnc1bTblMVs7hq
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 13 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe"C:\Users\Admin\AppData\Local\Temp\7d00f843ff9bee3803b1cc225bef580ac9b8df7c4f9b29fe8fcf1d2e2e778635.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cttunesvr.exe"C:\Windows\SysWOW64\cttunesvr.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1404-132-0x00000000002E0000-0x00000000006B6000-memory.dmpFilesize
3.8MB
-
memory/1404-133-0x00000000002E0000-0x00000000006B6000-memory.dmpFilesize
3.8MB
-
memory/1404-134-0x00000000002E0000-0x00000000006B6000-memory.dmpFilesize
3.8MB
-
memory/1404-142-0x00000000002E0000-0x00000000006B6000-memory.dmpFilesize
3.8MB
-
memory/2508-139-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-137-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-136-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-135-0x0000000000000000-mapping.dmp
-
memory/2508-143-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-144-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-145-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-147-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-148-0x0000000001211000-0x000000000121C000-memory.dmpFilesize
44KB
-
memory/2508-149-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB
-
memory/2508-150-0x0000000001210000-0x00000000015E6000-memory.dmpFilesize
3.8MB