4807e30569af6120a9b02a62d72405594d93a91cd949d91cb88f32e03daa73bd

Analysis

max time kernel
171s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WXCltAidEx.exe
Size

3.7MB
MD5

ed0ee4fc304cd842c9f6195a9c7116e4
SHA1

dddd35673a71deb7d2f379605b80ef02a94301cf
SHA256

103fb59fd4123c61cba74ce0a1bd9488f2b99bcc2eb3dbec82241753b0496701
SHA512

f390c6d6784e22bebbe585326af7dbe1bc3a5ce852c9a84fc3284bbfefde6f4fe199b1bd07792c3b3436822b333687ae9a675c6ce80d475dfab0b24b2e0b1a28
SSDEEP

98304:6P/kTUx5T1TaGjY/V9m5qoU8xbWvsvujvrZBlZ:6P/k4x5Z7m9iqoU8xblujvVZ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/4248-132-0x0000000000DD0000-0x00000000016F5000-memory.dmp	vmprotect
behavioral2/memory/4248-133-0x0000000000DD0000-0x00000000016F5000-memory.dmp	vmprotect
behavioral2/memory/4248-137-0x0000000000DD0000-0x00000000016F5000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WXCltAidEx.exe

description	pid	process
Token: SeShutdownPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe
Token: SeDebugPrivilege	4248	WXCltAidEx.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WXCltAidEx.exe

pid process

4248 WXCltAidEx.exe
4248 WXCltAidEx.exe
4248 WXCltAidEx.exe

pid	process
4248	WXCltAidEx.exe
4248	WXCltAidEx.exe
4248	WXCltAidEx.exe

C:\Users\Admin\AppData\Local\Temp\WXCltAidEx.exe
"C:\Users\Admin\AppData\Local\Temp\WXCltAidEx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4248-132-0x0000000000DD0000-0x00000000016F5000-memory.dmp

Filesize
9.1MB

Download
memory/4248-133-0x0000000000DD0000-0x00000000016F5000-memory.dmp

Filesize
9.1MB

Download
memory/4248-137-0x0000000000DD0000-0x00000000016F5000-memory.dmp

Filesize
9.1MB

Download