8e0428963b01a1588da55251c97762e89e723105119df57f4d25480395eefb8e | Triage

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:33

Sharing

Report Analysis Logs

General

Target

injector.exe
Size

985KB
MD5

e5ad89e0cce625fde0ddec73721e1459
SHA1

42dbcc7f946bc373313cae17e9d940d916d24638
SHA256

8e0428963b01a1588da55251c97762e89e723105119df57f4d25480395eefb8e
SHA512

71afe5ad4bcb4099bcfd5b4944d8426887abbdee9f4d7e9946f5a50c70de7904bd781cc0d6a80d41d087a17235ba6160f835adea49930337df55281c137202b3
SSDEEP

24576:b5TUg+vOIcVZmtfA/yq+oPMIdvtkYGciFag:btg04fTqNP3vSFfs

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/872-54-0x0000000000AC0000-0x0000000000CC6000-memory.dmp	vmprotect
behavioral1/memory/872-56-0x0000000000AC0000-0x0000000000CC6000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

injector.exe

pid process

872 injector.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

injector.exe

pid process

872 injector.exe

C:\Users\Admin\AppData\Local\Temp\injector.exe
"C:\Users\Admin\AppData\Local\Temp\injector.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:872

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-54-0x0000000000AC0000-0x0000000000CC6000-memory.dmp

Filesize
2.0MB

Download
memory/872-56-0x0000000000AC0000-0x0000000000CC6000-memory.dmp

Filesize
2.0MB

Download