525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
Size

3.6MB
MD5

12528f6900a6a7b1079b148d6987248c
SHA1

f527de57eb87f9ef0e37c23abddf1907b7e50715
SHA256

525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f
SHA512

8bceb41b49c116f8fba327a37a41ae3b31eadcbd165d3417f683473ac61f36cd00477d6aa2dbcfdc780fd4181448aa87cf7c0e8a1f676ca9a1843b10fd1c6390
SSDEEP

98304:iih6F7MZrHRsgdDBtbd0QZ06nTKQUJlmP0PZLDTEZhmu76H+muF:l6FcrTBtb2KT1UPgUTEyu76H+9

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1144-55-0x0000000000400000-0x00000000006A1000-memory.dmp	vmprotect
behavioral1/memory/1144-56-0x0000000000400000-0x00000000006A1000-memory.dmp	vmprotect
behavioral1/memory/1144-58-0x0000000000400000-0x00000000006A1000-memory.dmp	vmprotect
behavioral1/memory/1144-63-0x0000000000400000-0x00000000006A1000-memory.dmp	vmprotect

Loads dropped DLL 4 IoCs

Processes:

525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe

pid	process
1144	525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
1144	525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
1144	525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
1144	525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe

pid process

1144 525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe

pid process

1144 525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe

C:\Users\Admin\AppData\Local\Temp\525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe
"C:\Users\Admin\AppData\Local\Temp\525abcd4247b2ba32eb57cd2080cf39dfa17ae5ed83a4b54a1b5e052c3c8aa9f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1144

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy1F55.tmp\SkinBtn.dll
Filesize
4KB

MD5
469a269cb39bbdcd1b0c87ad7f1671d6

SHA1
b4a1d87f72284d2cb9c9da6ba630f1bd04f583cf

SHA256
348edf909ff64071e76f935aa664ebbc08fb17a5d96434930e573dd1005ff27c

SHA512
b74e0b3c573fab6d12ee839ada1e1928cf3b337b9af3604ccb5caf393a5fc1d60229e0338cd0c629260d29f27f57e9578b939a1a0fab67cbb5f0e0d32595e344

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1F55.tmp\System.dll
Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1F55.tmp\WndProc.dll
Filesize
3KB

MD5
f0cb331dd4bd92a6ebce45e7cd1cf5ef

SHA1
b66ea0c10b08750295f2dc7c170b370402393214

SHA256
e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458

SHA512
7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1F55.tmp\nsDialogs.dll
Filesize
14KB

MD5
dab87894fbe35c7008be708a3d45bdee

SHA1
1159d2d106a1a2525458131013582b01a5807267

SHA256
12e30c084e0f07a00e45b9f8c5a1e77991195951ed1b2b391f425ee1d1dc5bb9

SHA512
7b6176f112a69b81f13e14f0aa0bc69968c4056ee6a92987250c2dd3297b4258b43dcae3a36aeeac22c6cf1d1919e94873b6c8dd7f2847e735bfe811c83d9147

Download Submit
memory/1144-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1144-55-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/1144-56-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/1144-57-0x0000000000CE0000-0x0000000000F81000-memory.dmp

Filesize
2.6MB

Download
memory/1144-58-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download
memory/1144-63-0x0000000000400000-0x00000000006A1000-memory.dmp

Filesize
2.6MB

Download