6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
191s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

츨11.27ɫ/츨11.27.exe
Size

2.1MB
MD5

9e2c071739ec34477c6a1237f42c92b0
SHA1

486773f66d4f22f0ddf0101629d3a2f959b7994c
SHA256

46ecf2080f94e17075c9501c32d47c82cfa834a9da6835318df6276a99eaf711
SHA512

cd40461b30a173a81db25c50e8785c31f441ecea327baf85833a809e4d22836f36e48f62b9652599f2e5b96da7638b49e1a2562cd2b5173fa87a7826d3300a58
SSDEEP

49152:FR2oTddQuFyp6ano1RYsj4Eh5SLiXw9ftPcnmZD:FHQNp6FYskEhiIwtt0nmZ

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral32/memory/3432-132-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-148-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral32/memory/3432-182-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral32/memory/3432-175-0x0000000002750000-0x000000000291D000-memory.dmp	vmprotect
behavioral32/memory/3432-177-0x0000000002750000-0x000000000291D000-memory.dmp	vmprotect
behavioral32/memory/3432-181-0x0000000002750000-0x000000000291D000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

츨11.27.exe

pid	process
3432	츨11.27.exe
3432	츨11.27.exe
3432	츨11.27.exe
3432	츨11.27.exe
3432	츨11.27.exe

C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.exe
"C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-132-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-148-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-175-0x0000000002750000-0x000000000291D000-memory.dmp

Filesize
1.8MB

Download
memory/3432-177-0x0000000002750000-0x000000000291D000-memory.dmp

Filesize
1.8MB

Download
memory/3432-181-0x0000000002750000-0x000000000291D000-memory.dmp

Filesize
1.8MB

Download
memory/3432-182-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3432-183-0x0000000002750000-0x000000000291D000-memory.dmp

Filesize
1.8MB

Download